[AntiOnline]

Greetings:

The problem, to put it more clearly is this:

If i change my e-mail address by updating my profile, the system changes my usergroup to "users awaiting e-mail confirmation" and sends a confirmation e-mail that has a link that needs to be clicked by the user to authenticate that he indeed has access to that e-mail account.

If, however, a user changes their e-mail address, waits to receive the confirmation e-mail, changes their e-mail address again, and THEN clicks the confirmation link, the system is basically confirming the second address, when it reality it should be confirming the first. (if that makes sense)

* jp@antionline.com

* i change the address to

* webmaster@antionline.com

* get my confirmation e-mail

* change my address to president@whitehouse.gov

* click on the link in the confirmation e-mail

* my now fully verified e-mail address on the system is president@whitehouse.gov

now the user can subscribe themselves to a thousand threads or so, and spam the living hell out of president@whitehouse.gov from our website. not good.

now, for a fix. what I think needs to happen, is that any user that's in the "users awaiting e-mail confirmation group" shouldn't be allowed to update their profile until they're out of that group
(aka by confirming their address). but, i'm not sure if that's the best fix, and if it is, i haven't found an easy way to do it yet.


thoughts, ideas?