Users to my forum can be invited or they can sign up and then I need to approve them. Previously if I invited them, they would simply accept and that would be that. Recently for some reason, even after I invited them, they show as a sign up to be reviewed and approved. Why is that and how can I turn it off? I invited them so I don’t want to then again approve them separately. Thanks Gordon

This was changed for security reasons: [image] Staff-generated invites bypass the must_approve_users requirement Feature We’ve had a serious security issue with the invite system. I guess it’s easily reproducible. Our site is on invite-only. In addition, we have checked “must approve users” in the settings. One of our staff issued an invitation with a max use greater than 1, thus not restricted to one email in particular (example below). [2022-05-26 16_24_30-Profile - Wall-E - Helionauts] That invite link circulated, and people could register with it. Yet we expected that when “must approve users” is checked … There’s currently no workaround: [image] Allow users invited by staff to skip approval Feature Yeah … long term solution I guess is to add a site setting that allows for the relaxed approval mode I guess, opt in. I worry though cause getting security right here is very very hard. The more edge cases we allow for, the more complexity and potential security flaws.

Thanks very much for the info! :sunglasses:

Why do I need to still approve users that I have invited?

Product Support

gordon_mrmoco (Gordon) July 7, 2022, 11:30am 3

Thanks very much for the info!

Topic		Replies	Views
Allow users invited by staff to skip approval Feature invites	21	2624	April 12, 2023
Invite redemption allowed user to access forum BEFORE approval Bug approval , invites	6	3316	January 13, 2022
Reviewing New Members Product Support	5	732	June 7, 2022
Only admin has the invite button on approval required site Product Support invites	9	1547	July 18, 2024
Approval not triggering when sending an invite? Product Support approval , invites	3	240	October 30, 2020

Why do I need to still approve users that I have invited?

Related topics