MadHatter wrote:this is the only thing that I'd have to reproduce on my side if I wanted to sign up with an invalid email.
// // Generate a random password of length $len // function random_pass($len) { $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; $password = ''; for ($i = 0; $i < $len; ++$i) $password .= substr($chars, (mt_rand() % strlen($chars)), 1); return $password; }Indeed: now, tell me how you plan on generating the password you were assigned from that? The whole point of it is that it's generated randomly
MadHatter wrote:when I delete these accounts I research the domains that the emails use, and 100% of them do not exist. yea they could sign up with one email, sign in, and change it, then post spam, but that type of critical thinking might lead to some sort of progress in the way of fixing the issue and is therefore dangerous.
I'm not quite sure what you're getting at to be honest
Out of curiosity though, what forum(s) are you referring to?MadHatter wrote:at the very least, adding logging to the forum for actions like registration, password, and email changing would help narrow down the point of attack, and would allow you to "fix" the area of exploitation.
What kind of logging would you propose adding and how would it help?
you're right...
there's no better way than whats been implemented.
nothing else anyone can do outside of whats been done.
if you want your official punbb forum, you just have to deal with the spam.
glad I finally figured that out. I'm a bit slow so you'll have to forgive me (us) for thinking all this massive spam is a problem.
please continue (not) developing the next version.
