Wedge

Correct. I believe SMF has patched it as best possible given the nature of the caches though.I get what you're saying but I don't think it's that big a deal to be honest. How about we try it and see how people react?Heh, well if we do this, it will definitely be fixed. ;)

Well, actually I'm not so sure about that.

You can't change password or email from the profile page - unless you can actually provide the password anyway. Not even admins can change their own password or email without knowing their current password. Now, I'm suggesting a button that essentially resends the password change email - it will only send it to that email, which is in practice no different to just going to action=reminder and filling in the name/email anyway. In both cases, the email goes out and in both cases it would be possible regardless of being logged in or not (since you can call for a forgotten password with the username, rather than the email address)

Re plugin, you could do some of it with CPF but you'd have to have the other stuff tied to it which is a source change (since I'm not sure on how much of a plugin that could be)...

The thing is, what if I register and answer (a) but then I hop on the forum from an internet cafe or similar? It needs something a bit more than that, actually.

Sure it is, though it does make life interesting for plugin authors - if it does get implemented I'd rather keep it as straightforward as possible for developers.

OK, so I thought about implementing a CAPTCHA for the reminder widget. It is a method of identifying email addresses - and it never gets trapped by the error handler anywhere - and ultimately something that's going to limit the points of intrusion can only be a good thing.

So I started looking at the code and something odd about action=reminder struck me: it still works for logged in members too. Now this is really weird because I'm not sure it isn't a bug, but I'm not sure it isn't intentional behaviour either.

Let me explain. If you hit up action=reminder, you get thrown into the reminder handler, which has a bunch of subactions. But if no subaction is given, it will actually load the 'please give us the username or email address' prompt, due to no specified subaction, the relevant template being loaded and then hitting up template_main from Reminder.template.php.

That part seems half like an oversight, but the more I play around with it, the more I'm not sure about it being one. It seems almost fortunate that it happens to fall into the main reminder template (as opposed to other places, i.e. almost everywhere, where it explicitly sets the subaction if no valid one was found or none was supplied), but I don't see any 'is_guest' checks.

Then it hit me. You can't change your own password if you don't know your current one - and there's no way in the profile area to change your own password directly if you have forgotten it, meaning if you did want to change anything, you'd have to go through the reminder section - and it would let you, though whether you should be able to do so is debatable.

So, there's the question: should you be able to call the reset-password stuff if you're logged in, and if not, how should you be able to reset it from inside the profile area, since you can't change your password if you can't remember your current one?

It's a tricky one, but something that occurs to me. (Of course, I could just ignore it, implement the CAPTCHA anyway, and just not bother if the user is a registered member at the point of filling in the form)

The one problem is how I indicate from a 'child plugin' that it requires these features from a parent package, like in this case how we indicate that <arcade-game> block in a plugin is dependent on a given plugin being installed and enabled.

I suppose what could be done is if the plugin indicates it needs the handler function as part of the <required-functions> block?

Not a hope in hell of us writing anything for SMF, to be honest. Wedge has a blog function in it too though it needs more work yet, and the whole point of working on Wedge was to build on SMF, not to work on SMF itself, for us working on an SMF mod would be a backwards move.

Why can't you, for instance, upload items to media and just embed them in bbcode-written blog posts? All you're lacking, really, is convenience, not core functionality?

(And if I'm being cynical for a moment, $15 buys about 20 minutes consulting time, which isn't even close to building anything.)

I do get what you're asking but I hope you'll understand why we can't consider it realistically ourselves.

Oh, sure, I just figured that it was a conversation worth having - and you KNOW we'll be asked about it.