Hi all, one of our users had their account compromised. The workflow to mitigate that was far from ideal. The rails console was needed for: Force changing the e-mail address Force changing the password to something random to force a password reset via e-mail Killing all active sessions Furtherm…

All of those actions can also be performed from Admin > Users page. I am not sure what gave you the impression that it was only possible from console?

Changing the e-mail there sends a prompt for confirmation to the new one, but does not remove the old one immediately. The deactivate account button may have been right, but it’s not clearly labeled whether that enforces a password reset via e-mail. I still wasn’t able to find a kill all sessions …

If you have plausible reasons that a user’s email is compromised which in turn has resulted in their discourse account being compromised, You can as an administrator change their email and remove the old email. You can simply mark an account as deactivated which will force a re-verification of emai…

[圖片] itsbhanusharma: If you have plausible reasons that a user’s email is compromised which in turn has resulted in their discourse account being compromised, You can as an administrator change their email and remove the old email. No, I tried that and I could not do that because it generated…

In such a case, suspension can be used instead.

I opened this as a bug report/feature request on purpose to possibly make it better later, the concrete task is already been done and the user got his account back.

I’m not so sure this is a bug. This is not even an edge case imo. Users being careless about their data or identity is not a common occurrence and there are enough safeguards present. Making this process easier would potentially have more side effects. This is not something people should have to dea…

Also, there’s no button for increasing the time of a suspension without lifting it first.

[圖片] itsbhanusharma: Maybe the copy could be improved a bit but definitely not in favour of adding more options to the ui. What’s wrong with a deauth all sessions and force password and force e-mail change button? Seen that in other software.

Staff using it maliciously for once.

处理被盗用户账户不应需要控制台

支持安装

itsbhanusharma (Bhanu Sharma) 2026年三月17日 11:57 2

所有这些操作也可以从“管理”>“用户”页面执行。我不确定是什么让您觉得只能从控制台进行？

話題		回覆	觀看
How do other admins deal with compromised accounts? Community Building	9	526	2025年九月16日
Make it possible to activate a changed email address in the Admin UI Feature users	4	246	2026年六月14日
Changing a user's email Bug	16	2307	2020年十月7日
Change staff email address from console Self-Hosting rails-console , how-to	1	8000	2026年二月23日
Change email for SSO user? SSO	34	10029	2024年九月9日

处理被盗用户账户不应需要控制台

相關主題