block channel removal for 48 hours after changing the account password, since the password is required to remove a channel. Somebody looking at an open session on somebody else's computer can simply change the password and then proceed to maliciously remove the channel. This change gives the owner 2 days to discover that something is wrong and recover his/her password and potentially save their channel from getting erased by the vandal. This is most likely to happen if a relationship has gone bad, or something incriminating was found in your private messages when you left your computer briefly unattended.

1 files changed, 8 insertions, 0 deletions

diff --git a/mod/removeme.php b/mod/removeme.php
index f0b4ae3c0..095570480 100644
--- a/mod/removeme.php
+++ b/mod/removeme.php
@@ -23,6 +23,14 @@ function removeme_post(&$a) {
 	if(! account_verify_password($account['account_email'],$_POST['qxz_password']))
 		return;
 
+	if($account['account_password_changed'] != '0000-00-00 00:00:00') {
+		$d1 = datetime_convert('UTC','UTC','now - 48 hours');
+		if($account['account_password_changed'] > d1) {
+			notice( t('Channel removals are not allowed within 48 hours of changing the account password.') . EOL);
+			return;
+		}
+	}
+
 	require_once('include/Contact.php');
 
 	$global_remove = intval($_POST['global']);