Zen Cart Logo
Forums / General Questions / Page response on Forgotten Password form

Page response on Forgotten Password form

Locked

Views: 682

Results 1 to 3 of 3
This thread is locked. New replies are disabled.
27 Aug 2010, 10:45 PM
#1
timatidg avatar

timatidg

New Zenner

Join Date:
Jul 2010
Posts:
5
Plugin Contributions:
0

Page response on Forgotten Password form

We just received a complaint about the forgotten password page not working.

In reality, it works fine IF the user has an account.

However, if they have no account /index.php?main_page=password_forgotten&action=process&zenid= just shows the same form again with no message about no such account existing.

Forgotten Password
Enter your email address below and we'll send you an email message containing your new password.

How can this be fixed, please!

(The same problem exists if someone puts in a user and password in the login and there is no account. There is no error message, the page just redisplays. Most systems reply with a general message of "This username or password is wrong" or some such thing so you don't give away which part is true. With no message, it looks broken!)
Version: v1.3.9b

27 Aug 2010, 10:48 PM
#2
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: Page response on Forgotten Password form

So, if a hacker is sitting there trying to guess at email addresses or passwords, are you suggesting that you want to tell them exactly why they're not getting any answer?

It is unwise to tell them "sorry, that's an invalid address". It's better to leave them wondering.

27 Aug 2010, 11:03 PM
#3
timatidg avatar

timatidg

New Zenner

Join Date:
Jul 2010
Posts:
5
Plugin Contributions:
0

Re: Page response on Forgotten Password form

Found the problem--Styles are hiding all error messages from the user!