[eluser]gh0st[/eluser]
I have been customising TankAuth for my modular setup and am checking every link/functionality to ensure it is working.
The forgot password functionality doesn't even validate the person's details and you can just put any username (it doesn't even matter if it exists) and it will return a "success" view.
You should do the following:
+ Only allow email on the forgot password form
+ The email needs to be validated via an email callback to ensure the user exists
There are other occurances in other parts of Tank Auth where this happens, or a similar thing to it happens.
Please review Tank Auth and do the following:
+ Fully remove all hardcoded links and put it in a config file (I've had to do it myself in my build)
+ Check that the functionality actually works; if the forgot password functionality doesn't care about validating users -- what other functions do this too?
