block channel removal for 48 hours after changing the account password, since the password is required to remove a channel. Somebody looking at an open session on somebody else's computer can simply change the password and then proceed to maliciously remove the channel. This change gives the owner 2 days to discover that something is wrong and recover his/her password and potentially save their channel from getting erased by the vandal. This is most likely to happen if a relationship has gone bad, or something incriminating was found in your private messages when you left your computer briefly unattended.

1 files changed, 2 insertions, 1 deletions

diff --git a/mod/settings.php b/mod/settings.php
index e036755fc..6c11fbc9b 100644
--- a/mod/settings.php
+++ b/mod/settings.php
@@ -202,10 +202,11 @@ function settings_post(&$a) {
 			if(! $errs) {
 				$salt = random_string(32);
 				$password_encoded = hash('whirlpool', $salt . $newpass);
-				$r = q("update account set account_salt = '%s', account_password = '%s' 
+				$r = q("update account set account_salt = '%s', account_password = '%s', account_password_changed = '%s' 
 					where account_id = %d limit 1",
 					dbesc($salt),
 					dbesc($password_encoded),
+					dbesc(datetime_convert()),
 					intval(get_account_id())
 				);
 				if($r)