contao/test — Issue #2685: Lost Password could make activation e-mail worthless
Author: importer
Created: 2011-11-29 10:06:55+00:00
State: open
Labels: Defect, registration

When a member requests a new password before he has activated his account, he will no more be able to complete the activation process. The reason is that both the modules Registration and Lost Password store their token in the same field ('activation') in the member record. A new password request results therefore in the replacement of the original activation token by the new password token, thus making the link in the activation email worthless.

I think this is a bug. The modules must use separate fields.

I came across this problem when I imported a few thousand persons from an other system as members. They were given an activation token and were invited by e-mail to activate their accounts by clicking the embedded activation link. About twenty persons tried the Lost Password service before activating their account. It was hard to find what caused the mysterious disappearance of the activation token in their records.

--- _Originally created by pvanwaesberghe on November 19th, 2010, at 10:23pm (ID 2685)_