Hi, I have problem dealing spam accounts, they are created through local accounts, If I look into one spam account, it says primary email not verified, I want to disable this kind of accounts to create a new Topic until they verify their email, how to achieve this?

If their emails aren’t verified then they shouldn’t be allowed to post. Are they staged users? (That is, do you allow anonymous users to email in?)

That is, do you allow anonymous users to email in? how to check this? there is a settings enable staged users which says Automatically create staged users when processing incoming emails. and it is checked. is this what you are asking? [discourse-meta-0] This is how that spam account permission looks right now.

It doesn’t look like that’s a staged user. I’m not sure how people are logging into your site with an unactivated account. Do you have any special login methods?

Do you have any special login methods? Only two methods, local login and google oauth. I’m pritty sure he is not using google his domain is not under gmail. I see there is another thread with similar issue as mine [תמונה] Enable Email Verification to Prevent Spam Support It does sound like something is not set up quite right. It can be tricky taking over an existing forum as there are often bits and bobs that have been changed or added over the years that can take a while to track down. If you have a standard login it should behave in a very similar way to how you signed up for an account here. Do you have a forum URL you can share? (in a PM if you’d prefer not to share it publicly) I dont know if any progress on that thread.

Ah yes, we discussed that further in PM. That was down to SSO not verifying the emails before passing them to Discourse.

How can I proceed further to find the root cause of this issue? should I contact you (or someone) through DM?

No, you’re best off having a public topic so other people can weigh in with ideas if they have some. :+1: I’m afraid I don’t have many more ideas for what has happened. Did someone deactivate their account after they posted? (You can check your staff action logs for ‘deactivate user’)

Yes, I deactivated that account after I saw that account created one spam topic, nginx’s access.log didn’t show any new topic activity either from this user. I’m really confused how this guy creating new topic without using web interface, there should be some other way to create topic other then the web interface, thats why asking help here.

If you deactivated the account then that would explain why the email is unverified (them needing to reverify their email is part of the deactivation)

No, the account posted a spam topic first with unverified email, thats why I deactivated that account.

השבת משתמשים שלא אומתו ליצירת נושאים

תמיכה

Mohan43u (Mohan Raman) 26 ביולי,‏ 2024,‏ 4:23pm 22

If the user delete their account from their profile, do the logs will show system in user field? it should be showing ‘Test’ in user field right? there is something fishy here.

נושא		תגובות	צפיות
Enable Email Verification to Prevent Spam Product Support	10	664	26 ביולי,‏ 2024
New users that have never been Seen or Activated Community Building	25	460	6 בנובמבר,‏ 2026
Remove email verification Product Support	5	1505	16 במרץ,‏ 2022
Auto-activate new users Product Support	25	5013	21 בספטמבר,‏ 2020
Activating users without email? Product Support	14	2848	4 בדצמבר,‏ 2018

השבת משתמשים שלא אומתו ליצירת נושאים

נושאים קשורים