Staff cannot manually activate invited accounts after 48 hours has elapsed

Contribute Bug
9

I can repro the issue described by @Steve_Pavlina and @Benjamin_Mosior .

Here are the repro steps:

  • Invite a user to forum
  • User accepts the invite, but does not click on reset password email or activate account email link
  • User now has “active” account on forum, but the account is actually not active because email is not confirmed yet
  • When user tries to login, they get “account not activated” error

Now, there is an additional issue here which @Steve_Pavlina is facing:

This is because of this logic, specifically:

 if email_token = self.email_tokens.active.first

We are only confirming active email tokens (by default: created in last 48 hours), so if the Admin tries to manually deactivate/activate the account after 48 hours the older email tokens are not getting confirmed, only the active field in user account is set to true.

But when user is trying to login, we are checking if user has any email token present, and if present, one of them must be confirmed. So there is a divergence here.

Since this fix involves changes in login related code path, I need to look more into it (and confirm) before suggesting a fix.

Kudos to @Steve_Pavlina for his indispensable support to help me repro this issue. :+1:

7 Mi Piace