View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
0007006 | mantisbt | security | public | 2006-04-29 11:31 | 2006-05-07 03:51 |
Reporter | hcey | Assigned To | vboctor | ||
Priority | normal | Severity | major | Reproducibility | always |
Status | closed | Resolution | fixed | ||
Product Version | 1.0.2 | ||||
Fixed in Version | 1.1.0a1 | ||||
Summary | 0007006: Login with disabled account possible | ||||
Description | With this bug it is possible to login although an account is disabled. I go to www.myserver.com/mantis/ and click "Lost your password?" and then enter the data of my disabled account. | ||||
Tags | No tags attached. | ||||
In lost_pwd.php: Replace: With: I haven't got a chance to test this fix, if someone confirms that it is working I'll commit it into CVS. Otherwise, I'll get to it later. |
|
I tested your query, and it works correctly, with it set, I get the following on the lost_pwd_page.php APPLICATION ERROR #1903 Without the fix, I get the email sent correctly to the disabled user. Fix works, go ahead and submit :) |
|