Details
Bug
Closed
Critical
Description
if (!empty($CFG->deleteunconfirmed)) {
$cuttime = $timenow - ($CFG->deleteunconfirmed * 3600);
$rs = get_recordset_sql ("SELECT id, username
FROM {$CFG->prefix}user
WHERE confirmed = ********1**********//this seems wrong
AND lastaccess > 0
AND lastaccess < $cuttime
AND deleted = 0
AND (lastname = '' OR firstname = '' OR email = '')");
while ($user = rs_fetch_next_record($rs)) {
if (delete_records('user', 'id', $user->id)) {
mtrace("Deleted not fully setup user $user->username ($user->id)");
}
}
rs_close($rs);
}
We need to evaluate this more, but this definitely seems wrong and may result in major data loss.