To change your password, old password must be entered unless you're a moderator or administrator.

How about changing the email address can only be made if you put the current password too? Because with the current structure, if someone left their account logged in, then somebody else use that account, they can just change the email address, then use the Forgot Password function, then change the password. You know that moderators can change other members email, right? Honestly we can hack their account and they can not access their account anymore without the Ban function. Haha. Though i wont do that. But if others might have problems with other members, they can block them out. Lol. But im not so sure with this. I havent tried it.

uhm. sir admin. i realized just now. isn't it harmful, if mods can change his/her password w/o insert the old password ? if there is a mod that leave his account logged in. than someone abuse it and change the password. that someone can mess this forum, at least a section. abusing mod's account is more harmful than abusing other rank's account.

uhm. sorry about that. i think i wasn't a mod when you guys discussed bout it. but by changing our password doesn't mean we are not serious with our responsibility. it's okay dude. just a suggestion. and admin's power

[quote=eehjhay]How about changing the email address can only be made if you put the current password too? Because with the current structure, if someone left their account logged in, then somebody else use that account, they can just change the email address, then use the Forgot Password function, then change the password. You know that moderators can change other members email, right? Honestly we can hack their account and they can not access their account anymore without the Ban function. Haha. Though i wont do that. But if others might have problems with other members, they can block them out. Lol. But im not so sure with this. I havent tried it.[/quote] I'll consider to implement this idea later on. For now, if something like that happens I'll only remove him/her from the moderator team, just like what I did to one moderator today. He changed the email of some old members (including a couple of ex-moderators) and breaking in into their accounts by using "forgot password" function. Password change is irreversible so those members won't be able to login with their original password anymore should they ever come back. Even though those members are not active anymore, I see it as serious privacy violation (and an abuse of moderation power). Normally I don't bother checking the forum logs, but if there's problem like this I'll dig the logs to show me who did what.

Though we all have to be responsible on all our possessions, specially on our accounts. Carelessness wont be tolerated. If the forum logs include the ip address of all users on all of their browse history here, maybe we could possibly accept the excuse of someone hacked their account and the similar. Other than that, be careful on browsing and accessing on your accounts.