Captcha

[rsrobbins]

I need to add a captcha to the password reset form because someone tried to reset a member's password hundreds of times. I want to prevent bots from abusing the system.

I almost have this working except you can enter any text and it will go through even though the text does not match the code. The only sample code I have to go on is for the captcha on the sign up form. This line of code appears to be checking the result of trying to save the captcha:

if (is_array($result = $profile->save($captcha))) {

Since being able to abuse the password reset form is a general security flaw in the Ning platform I hope someone on their development team addresses this issue.

[rsrobbins]

I successfully added my own captcha to the password reset form without using Ning's version. Since nobody appears to be interested in security I won't bother sharing my code.

[Enric]

That's really a childish attitude... and if that's how it's gonna be you better don't come back around asking for help in any other matter, don't you think?

If nobody answered you -in 1 day, for God sake!- it might be due to many reasons... among which the fact that's the middle of summer might indeed be one!.

[rsrobbins]

Working with Ning is very frustrating. Anyway, it was completely unnecessary to add a captcha to the page where I added it because only the administrator can change his password there.