Bug in mail validation for email changers <-> forgotten password

[Nightborn]

Okay, I overlooked something.


When you have the setup:

email necessary
email needs validation
you let players change the email
and require validation
and sent to the OLD account email OR the NEW account email

then you can bypass the validation which needs to be clicked on in the mail by simply requesting a forgotten password. that will overwrite the email request ID and you can basically do the following:

capture a password
get into an account, request a change of email
change the password

then ONCE the old old owner cannot get in, requests a forgotten password
CLICKS the link --> he changes the email address to the new, fraudulent one.

I have fixed this, but you need to copy the files:

create.php
prefs.php

from the now updated archive to your version

AND

generate a new field in the accounts table:

name: forgottenpassword
type: varchar(32)
default: ''

or else you'll get error messages.

[Nightborn]

Please download anew and replace the dragon.php

  if you do a DK, the email request field gets reset ... I forgot to include it there...

not that this also affects the circulum vitae, you need to make the two new fields persistent in the CV editor.