The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Hello,
I have a question about the functionality of this module. Say for instance a user changes their email address, but makes a typo in doing so. If the typo email address happens to be valid, then the change confirmation email would be sent to someone else. If this person clicks the link in this email they would be sent to the site with a message stating that the email address has been changed to their email address. Since the account is now linked to this person's email address, couldn't they request a new password and gain access to the account? Is there anything this module does to prevent this?
Thank you for your time,
Paul
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | email_confirm.module.D6.patch | 1.38 KB | bwinett |
| #2 | email_confirm.v6.patch | 926 bytes | MarcElbichon |
| #2 | email_confirm.v7.patch | 1.05 KB | MarcElbichon |
Comments
Comment #1
jaydub commentedActually you do bring up a valid point. The module was based on a patch to core as discussed in #85494: Use email verification when changing user email addresses and that initial implementation supported a user being able to verify the changed email via the confirmation link in email without being logged in.
I suppose it makes sense to force the user to be logged in before accepting the confirmation link click.
Comment #2
MarcElbichon commentedThis patchs (for V6 and V7) add a setting to force user to be logged when validate confirmation link.
Must be applied to dev versions (2012-Jun-14)
Comment #3
bwinett commentedI made some language changes to your patch for v6. Changed "connexion" to "authentication" and "connected" to "logged in" - the visitor needs to be authenticated ("logged in", in parlance site visitors will understand). Also, the following change from:
to
resulted in an error for me (error indicated that the 2nd parameter in array_key_exists must be an array or object), so I removed it. I don't know what it was supposed to fix, so couldn't test it.
My edited patch is attached.
[edit] BTW, thanks for this patch!
Comment #4
MarcElbichon commentedYou are right for your modifications.
Use of array_key_exists was a wrong backport from D7 version.
Comment #5
MarcElbichon commentedDo you have planned to include patch in further release ?
Comment #6
gregglesThe 7.x has a fix for this included by requiring the email being changed to match the currently logged in user. The 6.x version is no longer supported, so closing this out.