I haven’t found a way to reproduce this issue, but over the past month I’ve noticed two instances where a user was supposedly deactivated (as seen from the staff action logs) but not actually deactivated (the user could still log in). For example, this one was “deactivated” 29 days ago, but was able to send me a private message today (the only other staff actions after the deactivation are “check email”) [CleanShot 2022-08-31 at 07.19.41@2x] This is the other one (a different staff member was able to “deactivate” the same user again 4 hours later without a previous reactivation): [CleanShot 2022-08-31 at 07.38.24@2x] I’m on 2.9.0.beta9

[image] Nacho Caballero: I’ve noticed two instances where a user was supposedly deactivated (as seen from the staff action logs) but not actually deactivated (the user could still log in). This can happen. All a deactivated user needs to do to re-activate their account is to attempt to login to the site, then click the link in the activation email that’s sent to them. When a deactivated user attempts to login they will see this modal: [20240922_23h02m09s_grim] Discourse will send them a “Confirm your new account” email: [20240922_23h06m08s_grim] After clicking the link in the email, the user will be logged into Discourse. This has been the behavior for as long as I can remember. I don’t think it’s a bug, but I could be wrong about that. Sending a “Confirm your new account” email to a user who already has an account seems a little off. Edit: to get the behavior you are looking for, you probably want to “suspend” the user instead of deactivating them.

This issue is still ongoing (it happens several times a month). Has anyone else noticed it? This is the controller code app/controllers/admin/users_controller.rb main def activate guardian.ensure_can_activate!(@user) # ensure there is an active email token if !@user.email_tokens.active.exists? @user.email_tokens.create!(email: @user.email, scope: EmailToken.scopes[:signup]) end @user.activate StaffActionLogger.new(current_user).log_user_activate(@user, I18n.t("user.activated_by_staff")) render json: success_json end def deactivate guardian.ensure_can_deactivate!(@user) @user.deactivate(current_user) StaffActionLogger.new(current_user).log_user_deactivate( @user, I18n.t("user.deactivated_by_staff"), params.slice(:context), ) refresh_browser @user The StaffActionLogger is working correctly, but I’m wondering if something in the User.deactivate method might be failing. What the errors have in common is that they’re coming from API requests. This is what I typically use: PUT https:// /admin/users/ /deactivate Api-Username: Api-Key: data: {context":"/admin/users/ / "} I always get “success: OK” Is there any other log I could check out or thing I could try? I’m on 2.9.0.beta11

This is still happening sporadically. For example, this user was initially “deactivated” on August 23, but I just noticed now that they were still active and actually deactivated them. How can a user be deactivated twice (without a reactivation in between)? [2024-09-23-discourse-bug] I have a daily task that runs a query to check for this situation. It returned nothing yesterday and this one user today, so what seems to be happening is that the user was correctly deactivated on Aug 23, but it somehow got activated yesterday (without it being logged anywhere). Is it possible to activate a user (via API or UI) and not leave a trace? I’m assuming this could only happen by modifying the database directly, which I’m certain I didn’t do (I’m the only admin).

Deactivated users are sometimes not being deactivated

Product Support

Nacho_Caballero (Nacho Caballero) September 24, 2024, 8:06am 6

Mystery solved! Thanks, Simon. You can close this thread.

Topic		Replies	Views
Cannot activate a user with an unconfirmed email token Bug	10	1210	February 14, 2018
User keeps getting reverted to inactive Product Support	7	881	November 7, 2019
Deactivating a user causes account to be deleted? Product Support	14	2018	August 23, 2017
User get deactivated, need to know why Product Support	9	902	January 28, 2020
Deactivated by staff not being logged Bug	7	845	May 8, 2018

Deactivated users are sometimes not being deactivated

Related topics