Forgot password/username

Hi

Wanted to ask - If for example a guest goes to "forgot login/password" page, and let's say for example that the guest knows someone's email in the site, and inputs that email in "forgot login/password", will the password and/or login just change and the real user will just receive an email that his/her password/username is changed?

Cheers

It'll change and send the new password to the email address associated with the account. If CB Captcha is installed it can be enabled to have captcha on forgot login to help stop spamming.

So this means that this is a bug?

Yes let's say that I received on email the new password but I didn't want to change the password... why should I go and spend time to change again the password to the one I had before + what if the other person again does this and again ... this is definitely not good for the normal user...

No, why would it be a bug? It's how nearly all password resets work. The alternative is to send a confirmation before the change then only change after the link is clicked, but that's not commonly used. Something we'll improve with CB 2.0 of course, but as is it's fine and has been this way for years (this is also how Joomlas functions).

Yeah I also thinked that the user should first "confirm" the password change, I think you agree with me that this is not really a very "correct" way how it works now?

Maybe you can make this for 1.8 version?

I don't agree, it's normally how password resets work. The confirmation email is something new that sites have begun using. We'll be improving on this in CB 2.0, but how it is now is how it is staying for CB 1.x releases. When you've millions of people using to doing X you don't change it to doing Y as it causes a lot of confusion and issues. CB and Joomla have functioned this way for years. Suddenly changing the entire process is not a change we can make in a 1.x release as users expect it to function how it functions now. However, again this is something we'll improve with CB 2.0 where it's an openbook and we're free to make large changes.