Last modified: 2013-11-30 16:38:17 UTC
It would be a nice idea to notify users by email (when they have a address setup) that their account password has been changed.
*sigh* I hate adding user prefs, but I'd want to disable this...
Why?
Why should we add such a feature, or why would I want to disable it?
Currently we have an account swiping problem. If someone gains access to a session, they can escalate that to exclusive full account control by changing the e-mail and using password reset. This process has no notifications (which should be in place) to warn the user that their account has been swiped.
I'd argue requiring a password to change the email would be a much more effective means to prevent that attack though.
That's bug 20185.
(In reply to comment #3) Why would you want to disable that?
(In reply to comment #7) > (In reply to comment #3) > Why would you want to disable that? Because I don't like getting extra e-mails? Especially when it's about an action I initiated myself.
> Because I don't like getting extra e-mails? Especially when it's about an > action I initiated myself. I think you /would/ want that in case it wasn't you who initiated it. How often do you change your password? I don't think most people have ever changed their password. Much less doing so often enough to be annoying.
Hello, I would like to solve this bug. I believe solving this would require editing of execute() in Special:ChangePassword file to add a sendmail() function along with creation of some messages (in MessagesEN.php) which would form the body of the mail as parameters to sendmail(). This process would be somewhat similar to what has been implemented in PasswordReset. Kindly guide if this is the correct approach and I should go ahead with it. Thanks, Aashish
You would user UserMail, but otherwise yes, that seems the right process.
https://gerrit.wikimedia.org/r/48578
Patch in Gerrit needs review...
Maybe I should remove the tag, because I need to refactor that patch before it can be merged anyway.
Change 48578 abandoned by Parent5446: Notify user by email when password changed https://gerrit.wikimedia.org/r/48578
