On 08/08/2015 05:25 PM, Andrew Shadura wrote:
# HG changeset patch
# User Andrew Shadura <[email protected]>
# Date 1431821238 -7200
# Sun May 17 02:07:18 2015 +0200
# Node ID c4ad7e6deed43b0f725b60b37ae1d2161eead200
# Parent e84c2738fbd84569492c56e5a9361ee94af5d420
auth: secure password reset implementation
A couple of other comments after more testing:
It still sends a 'Your new password' (with the crypted password) after
setting it the new way. I guess it shouldn't.
When it gets to the 'set password for $email' page, the user has already
kind of 'authenticated through mail'. We could/should thus greet the
user with the full name and username so the user really know which
account is being changed.
(Actually, I wonder if "authentication through mail link" could/should
be one authentication method like anything else. That would be perhaps
be elegant ... but a different story.)
Also, as hinted before, I don't like the hidden fields with email and
timestamp. That makes it harder for the user to understand what is going
on. Showing them (disabled input fields?) would give the (expert) user
some important context.
/Mads
_______________________________________________
kallithea-general mailing list
[email protected]
http://lists.sfconservancy.org/mailman/listinfo/kallithea-general
