Registration allowed reactivation and resetting password of disabled
authorFlorent Bruneau <florent.bruneau@polytechnique.org>
Thu, 28 Oct 2010 20:44:25 +0000 (22:44 +0200)
committerFlorent Bruneau <florent.bruneau@polytechnique.org>
Thu, 28 Oct 2010 20:44:25 +0000 (22:44 +0200)
commit4c5a592172f6a06f1cf84d5b9212e81d0e4a4708
tree51682494d4917235ecc02cddf31ef0bc6443570a
parentb209d2bb3880141c51e4a5637b57635ee00e1d1a
Registration allowed reactivation and resetting password of disabled
accounts.

Registration didn't correctly check that the account was in 'pending'
state allowing a user to complete the first steps of the procedure before
falling on a SQL error on register/end. But, before the error,
register/end had time to update the state of the accounts table setting:
 - the new password (the one defined during the registration procedure)
 - the state to 'active'
 - the registration state

Signed-off-by: Florent Bruneau <florent.bruneau@polytechnique.org>
SECURITY
modules/register.php
modules/register/register.inc.php