Hi all, one of our users had their account compromised. The workflow to mitigate that was far from ideal. The rails console was needed for: Force changing the e-mail address Force changing the password to something random to force a password reset via e-mail Killing all active sessions Furtherm…

All of those actions can also be performed from Admin > Users page. I am not sure what gave you the impression that it was only possible from console?

Changing the e-mail there sends a prompt for confirmation to the new one, but does not remove the old one immediately. The deactivate account button may have been right, but it’s not clearly labeled whether that enforces a password reset via e-mail. I still wasn’t able to find a kill all sessions …

If you have plausible reasons that a user’s email is compromised which in turn has resulted in their discourse account being compromised, You can as an administrator change their email and remove the old email. You can simply mark an account as deactivated which will force a re-verification of emai…

[图片] itsbhanusharma: If you have plausible reasons that a user’s email is compromised which in turn has resulted in their discourse account being compromised, You can as an administrator change their email and remove the old email. No, I tried that and I could not do that because it generated…

In such a case, suspension can be used instead.

I opened this as a bug report/feature request on purpose to possibly make it better later, the concrete task is already been done and the user got his account back.

I’m not so sure this is a bug. This is not even an edge case imo. Users being careless about their data or identity is not a common occurrence and there are enough safeguards present. Making this process easier would potentially have more side effects. This is not something people should have to dea…

Also, there’s no button for increasing the time of a suspension without lifting it first.

[图片] itsbhanusharma: Maybe the copy could be improved a bit but definitely not in favour of adding more options to the ui. What’s wrong with a deauth all sessions and force password and force e-mail change button? Seen that in other software.

Staff using it maliciously for once.

处理被盗用户账户不应需要控制台

支持安装

itsbhanusharma (Bhanu Sharma) 2026 年3 月 17 日 11:57 2

所有这些操作也可以从“管理”>“用户”页面执行。我不确定是什么让您觉得只能从控制台进行？

话题		回复	浏览量
How do other admins deal with compromised accounts? Community Building	9	391	2025 年9 月 16 日
Make it possible to activate a changed email address in the Admin UI Feature users	4	158	2026 年6 月 14 日
Changing a user's email Bug	16	2216	2020 年10 月 7 日
Change staff email address from console Self-Hosting rails-console , how-to	1	7833	2026 年2 月 23 日
Change email for SSO user? SSO	34	9839	2024 年9 月 9 日

处理被盗用户账户不应需要控制台

相关话题