Backdoor magic link
After sending Christmas greetings using the tag "everyone", I received several congratulations in return and found that the original link to discussion continue gives direct access to the user's profile. This link has no expiration date, it can be freely shared and logged into the profile on any device, unlook if the site settings have a login time limit.
The link in the letter to administrator also gives access, but does not work when the administrator has a modified login path link.
I think this problem might be tough to solve. If we limit the time the link is active (like the Fluenauth plugin), it might lose its purpose. Users might not check their emails right away, and they might not even check them every day.
Until we find a solution, I suggest you make it possible to turn this link (not tag) off in the settings.
Olex Lipinski we can disable the Magic Link which allowes the user logging in by clicking it in the Settings area.
It would be really useful if we could specify the link expiration date (if someone wont click it in the timeframe there is a regular way of logging in so it shouldnt be any issue) and number of times for using the login link (by default=1 time).
Mat Yes, thank you, turned it off, somehow looked through it. But nevertheless, it's a backdoor