Actions
Task #5386
openIncrease security for Email Change
Start date:
13.09.2017
Due date:
% Done:
80%
Estimated time:
Sorting:
Commit Number:
Description
We already require OLD password when changing the current user password, but email is another way to recover an account. If hacker is able to access open instance of RC he can trigger an email change and change the password after that.
Proposed idea to fix this is:
- Make email a select field instead of text input
- Inside the input we allow user to pick any of the addresses added via extra emails
- In order to change an email user needs to add a new email from additional emails, this needs to require a password, and then he can select a new email from the entry.
THis should force users to give current password to change the email
Updated by Marcin Kuzminski [CTO] about 7 years ago
- Status changed from New to In Progress
Updated by Marcin Kuzminski [CTO] almost 7 years ago
- Target version changed from v4.11 to v4.12
Updated by Marcin Kuzminski [CTO] almost 7 years ago
- Assignee set to Bartłomiej Wołyńczyk
Updated by Marcin Kuzminski [CTO] almost 7 years ago
- Related to Task #5391: Secure Email change added
Updated by Bartłomiej Wołyńczyk over 6 years ago
- Status changed from In Progress to Resolved
- Assignee changed from Bartłomiej Wołyńczyk to Marcin Kuzminski [CTO]
Actions