- This topic has 5 replies, 2 voices, and was last updated 1 year, 5 months ago by
.
-
Posts
-
I had an email from a member who said she’d forgotten her password, but when clicking the link saying “Forgot Password”, it asked her to enter her email address, and then said “New password has been sent to your email address. Email address: j*****@hotmail.com (I’ve hidden the full email). This is alarming, as this hotmail address belongs to a completely different user.
I then tried it myself, and got exactly the same thing happen.
The __Password Reset page just has [swpm_reset_form] in it, so I can’t see if there’s anything odd going on in there. As it’s renewal time for our members, and we’ve advised them to use the “Forgot password” link if they need to, I’m worried that the j**** person is going to be inundated with emails to reset the account; and whose account would it reset?
Please turn on the debug logs and try your test again. Also, ensure your membership tables show the correct information.
Thanks very much for your reply. The membership tables are correct, and indeed when I click on “Forgot Password”, it doesn’t matter what email address I put in, it sends an email to the j**** address. That person is a genuine member, whom I emailed to see if she was getting a lot of spam and she confirmed that she’s been getting ALL password requests. I can’t do the test again, because it will send out spam to this person so I need to understand where and how this particular email address got embedded into the reset password form. Since memberships are due for renewal this month, a LOT of people have clicked “Forgot Password”, which means this particular member’s email address is then visible to all of them – which is in contravention of GDPR.
I was hoping there was a way I (or someone more technically capable than I) could peer “under the hood” to see the code that presumably must be incorporating this person’s email address.
I asked you to turn on the SWPM debug logs, and perform the problem action(s). Please do so and post the contents of the debug log example here.
I can’t do that, unfortunately. If I repeat the action, our already annoyed member will get spammed with a reset password email yet again, and she’s pretty fed up already. She could even report us for breaching GDPR rules.
Simply entering *any* email address in the box sends an email to her address, and also exposes her email address to anyone else who clicks “Forgot Password”, as it comes up and says “New password has been sent to xxx” where xxx is her email address.
As a temporary measure I’ve edited the page so that instead of bringing up the [swpm_reset_form] it just asks the person to email me so I can reset their password manually.
- You must be logged in to reply to this topic.