Giters

pennersr / django-allauth

Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication.

Home Page:https://allauth.org

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Default setting for ACCOUNT_EMAIL_UNKNOWN_ACCOUNTS (True) results in spam emails

longhotsummer opened this issue · comments

commented

The default setting for ACCOUNT_EMAIL_UNKNOWN_ACCOUNTS is True. This means the default configuration of allauth is effectively happy to send spam reset emails to arbitrary email addresses.

I suggest this default is changed to False.

commented

But, if I signup using your email address, the system will happily spam you as well. So, changing the default does not prevent spamming yet does break backwards compatibility.