See this comment

Comments

gengel’s picture

gengel commented

The case described here:

http://drupal.org/node/536272#comment-1917084

Depends on (1) a user changing their e-mail address to an e-mail address which she/he does not own and (2) Salsa Supporters being subsequently installed on the site.

There are a few solutions:

  • require that e-mail address changes get re-verified through the sign-up process
  • don't install Salsa Supporters on a site that is already live
  • prevent Salsa Supporters from syncing users that existed before it was installed
  • sync users that exist prior to install only by creating a new Salsa account (and possibly delete old Salsa accounts with the same e-mail address)
codewatson’s picture

codewatson commented

Just a quick note, this is not just an existing site/drupal user issue. Any user, whether created before or after the module is installed, can change their email address with the possibility of it switching their account to one that doesn't belong to them!

EDIT:
After reading the other thread, perhaps the best thing to do is a verification email of some sort. Would probably also need some sort of administrator manual verification.

Another option would be to have them use salsa's password set feature, then have them enter the password that gets sent to them into a drupal field, or as their drupal password before their account is accessible? We could keep their passwords synced as well that way, so if they change their drupal password it changes the one stored in salsa, to avoid confusion?

gengel’s picture

gengel commented

The work-around I've settled on for now is to check for the presence of the Email Change Confirmation module. If the module is present, it forces an e-mail security check much like the user registration e-mail. Otherwise, it forbids e-mail address changes entirely.

This isn't perfect - it still doesn't force e-mail verification during registration, for example - but as long as the admin knows what they're doing, it should handle most cases.

gengel’s picture

gengel commented
Status: Active » Closed (fixed)