When a user changes his or her email address using the UpdateProfile snippet, there seems to be no facility to verify that address the way the Register snippet does.
This would seem to be a serious missing feature in Login, since users would be free to register with a “real” address and then immediately replace it with a “fake” address.
Am I missing something?
Register doesn't really verify the address, it just sends and email to that address. Since the user can't reply without receiving the email, it's guaranteed to be correct, but only after receiving the reply.
There's no way to verify an email address without sending an email and getting a reply, which would complicate the UpdateProfile snippet quit a bit. I don't think I've ever seen a web site that verifies changed email addresses.
If it's a big concern, the simplest solution is to not let users edit their email addresses. They'd be forced to re-register with a new address if they wanted to change it.
I think you could add a postHook to UpdateProfile that sent an email to the new email address (a la Register) and "unchanged" the email address the user submitted. Then create a version of the ConfirmRegister page with a custom snippet that makes the change to the user's email address.
I understand the added complexity, but I beg to differ on whether this is a common feature. Most “A-grade” sites (especially forums, social networks, and other applications where identity is important) implement this.
I’ll definitely look into implementing the solution you recommend; however, as a serious tool for building serious sites I’d say a framework like MODX should definitely offer this functionality.
