validate email module

[chrisbraybrook]

a module designed to require users to re-validate their registered e-mail addresses. for use primarily in the case where we already have a lot of users without valid e-mail addresses in the system.

this module would lock the user's account until they input a valid e-mail address and verify it with the validation key sent to said address.

a companion module should also be written to run as a cron job every month or so, requiring that those who haven't validated their e-mail in 6 months do so.

note: any change to the e-mail address on a user's account should prompt a verification.

[chrisbraybrook]

i will not write the companion cron job module at this time, however, it seems important that we get valid e-mail addresses in the database. beginning research into this module.

[chrisbraybrook]

implementing this is no small task. users will be able to access this module either from the link provided them in the e-mail they receive, or by accessing the link in their "Edit Profile" module.

I am currently considering some security additions to the edit profile module so that someone cannot validate their e-mail address and then change it to something that doesn't exist or is not correct.

[chrisbraybrook]

The patch file I am attaching to this ticket will provide basic implementation for email validation, and require that the user validate their e-mail address when they change it in the edit_profile module.

However, it does require some changes to core functions and other modules, and is as yet a bit sloppy. Regardless, it does work.

[brad]

You may want to reconsider the cron issue. To me it edges over into possible spam. My alternative suggestion would be to have a way to lock an unvalidated user account after a certain period of time. That way the only users you're going to bother with validation are those that have *not* abandoned their account.

[chrisbraybrook]

email validation patch (build 1)

[chrisbraybrook]

with this patch, we can implement email validation. I am reassigning the integration of this patch into the core project for a later date.

[chrisbraybrook]

Replying to brad:

You may want to reconsider the cron issue. To me it edges over into possible spam. My alternative suggestion would be to have a way to lock an unvalidated user account after a certain period of time. That way the only users you're going to bother with validation are those that have *not* abandoned their account.

Hmmmm...a good point, which also lends towards cleaning up the database of users whose accounts have been locked for more than a certain period of time. (Like 2 months or so.)

(Yes, I only just saw this now.)