E-mail System Problem - Need Fix

[AntiOnline]

Greetings All:

I'm having problems creating a hotfix for this, very serious, problem that my users found with vb:

http://www.antionline.com/showthread.php?threadid=222304

Eventually the VB Developers will have to come up with a perminant solution in future versions, but for now, I'm just looking for a quick way to fix the problem.

Any ideas?

[Admin]

I can't recreate this "bug" locally. Are you sure your settings are set up correctly and that your user really did what he claims he did? Can you exploit that bug here?

[AntiOnline]

Greetings:

I was able to recreate it on my board.

It seems that vb.org doesn't do checking of addresses change in the profile? Or do you?

[AntiOnline]

Greetings:

The problem, to put it more clearly is this:

If i change my e-mail address by updating my profile, the system changes my usergroup to "users awaiting e-mail confirmation" and sends a confirmation e-mail that has a link that needs to be clicked by the user to authenticate that he indeed has access to that e-mail account.

If, however, a user changes their e-mail address, waits to receive the confirmation e-mail, changes their e-mail address again, and THEN clicks the confirmation link, the system is basically confirming the second address, when it reality it should be confirming the first. (if that makes sense)

* jp@antionline.com

* i change the address to

* webmaster@antionline.com

* get my confirmation e-mail

* change my address to president@whitehouse.gov

* click on the link in the confirmation e-mail

* my now fully verified e-mail address on the system is president@whitehouse.gov

now the user can subscribe themselves to a thousand threads or so, and spam the living hell out of president@whitehouse.gov from our website. not good.

now, for a fix. what I think needs to happen, is that any user that's in the "users awaiting e-mail confirmation group" shouldn't be allowed to update their profile until they're out of that group
(aka by confirming their address). but, i'm not sure if that's the best fix, and if it is, i haven't found an easy way to do it yet.


thoughts, ideas?

[hypedave]

whoa im running vb 2.2.5 and just created that problem again,
umm this aint good at all.

[Admin]

I still can't recreate this bug on my unhacked local board.

Looking at the code this shouldn't happen:
if ($verifyemail and $email!=$bbuserinfo['email'] and $bbuserinfo['usergroupid']==2 or $bbuserinfo['usergroupid']==3) {
$newemailaddress=1;

// delete old activation id
$DB_site->query("DELETE FROM useractivation WHERE userid='$bbuserinfo[userid]' AND type=0");

// make random number
mt_srand ((double) microtime() * 1000000);
$activateid=mt_rand(0,100000000);

//save to DB
$DB_site->query("INSERT INTO useractivation VALUES (NULL,'$bbuserinfo[userid]','".time()."','$activateid',0)");

$username=unhtmlspecialchars($bbuserinfo['username']);
$userid=$bbuserinfo['userid'];

eval("\$message = \"".gettemplate("email_activateaccount_change",1,0)."\";");
eval("\$subject = \"".gettemplate("emailsubject_activateaccount_change",1,0)."\";");

mail ($email,$subject,$message,"From: \"$bbtitle Mailer\" <$webmasteremail>");

$bbuserinfo['usergroupid'] = 3;
} else {
$newemailaddress=0;
}
See, it deletes the activation ID whenever you change your email address.