Don't allow password changing if the user isn't confirmed yet

diff --git a/login/forgot_password.php b/login/forgot_password.php
index 82961dedbad3e574bf81d1ca96ac4cb77caf9b5b..221e2dbd8a3459ee1ee155b7400913ef42e27a70 100644 (file)
--- a/login/forgot_password.php
+++ b/login/forgot_password.php
@@ -43,6 +43,10 @@
                        if (!$user = get_user_info_from_db("email", $frm->email)) {
                 error("No such user with this address:  $frm->email");
             }
+
+            if (empty($user->confirmed)) {
+                error(get_string("confirmednot"));
+            }
             
             $user->secret = random_string(15);