atutor/ATutor — pull request #101 by gbuckingham89 (2014-08-25 09:44:11+00:00)
Title: Fix for security issue that means the entire login process can be bypassed

By going to /confirm.php?auto_login=1&member_id=X (X replaced with a number), it is possible to login as any user of the system.

I've just added a requirement for the same code to be required in the $_REQUEST global variable to as is needed as part of the confirmation process.