Isn't it a bit too easy for someone to change everyone's passwords? Would be nice to have the option of requiring both username and email when you request new password.

Comments

jonbob’s picture

jonbob commented
Component: User system » user system
bradlis7’s picture

bradlis7 commented
Status: Active » Closed (fixed)

I think this issue is void, since passwords are no longer reset, but a temporary login is granted instead.

Marking closed.