# Cannot activate a user with an unconfirmed email token
**URL:** https://meta.discourse.org/t/cannot-activate-a-user-with-an-unconfirmed-email-token/80431
**Category:** Bug
**Created:** [February 13, 2018, 1:05am UTC](https://meta.discourse.org/t/cannot-activate-a-user-with-an-unconfirmed-email-token/80431 "2018-02-13T01:05:33Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [February 13, 2018, 1:05am UTC](https://meta.discourse.org/t/cannot-activate-a-user-with-an-unconfirmed-email-token/80431/1 "2018-02-13T01:05:33Z")
Steps to reproduce (I’m pretty sure)
- deactivate a user (e.g., ` User.where("active = true and admin != true").update_all(active: false)`)
- have the user try to log in or otherwise get a validation token created
- activate the user with things like `User.all.update_all(active: true)`.
Even though the user record shows “true” in the active field, they couldn’t log in. I tried a whole bunch of ways to activate a user (e.g., i called `user.activate` and `user.save`) and nothing kept the user from getting the “We sent an activation email, you need to follow those instructions” link when trying to log in until I finally found the email token and did
```plaintext
token.confirmed=true
token.save
```
and then the user could log in.
The lesson is probably don’t deactivate a user unless you really mean it. 🙂
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 13, 2018, 1:06am UTC](https://meta.discourse.org/t/cannot-activate-a-user-with-an-unconfirmed-email-token/80431/2 "2018-02-13T01:06:32Z")
This seems correct, the only way to activate a user is to validate the email. Deactivated even explains this in the UI…
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [February 13, 2018, 1:19am UTC](https://meta.discourse.org/t/cannot-activate-a-user-with-an-unconfirmed-email-token/80431/3 "2018-02-13T01:19:31Z")
> [@codinghorror](#):
>
> the only way to activate a user is to validate the email
Well, not really. SSO can skirt the requirement. And `rake admin:create` will activate a user. I just deactivated the all as part of the import and the admin didn’t want them deactivated, and the test site has outgoing mail disabled.
I thought that the ACTIVATE button on the admin screen would activate a user too, without sending the email.
But you don’t have to call it a 🐛 🙂
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 13, 2018, 1:25am UTC](https://meta.discourse.org/t/cannot-activate-a-user-with-an-unconfirmed-email-token/80431/4 "2018-02-13T01:25:48Z")
If it’s a problem with the UI then @jomaxro can try to repro that.
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [February 13, 2018, 1:28am UTC](https://meta.discourse.org/t/cannot-activate-a-user-with-an-unconfirmed-email-token/80431/5 "2018-02-13T01:28:26Z")
I’m confused. @pfaffman are you saying that if you deactivate and activate a user via `/admin/users/user_id/username` the user isn’t actually activated?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [February 13, 2018, 4:24pm UTC](https://meta.discourse.org/t/cannot-activate-a-user-with-an-unconfirmed-email-token/80431/6 "2018-02-13T16:24:23Z")
> [@jomaxro](#):
>
> are you saying that if you deactivate and activate a user via /admin/users/user\_id/username the user isn’t actually activated?
I suspect that’s the case. It may be, though, that this isn’t replicable via the UX and I should just move this to #Development.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 13, 2018, 11:16pm UTC](https://meta.discourse.org/t/cannot-activate-a-user-with-an-unconfirmed-email-token/80431/7 "2018-02-13T23:16:40Z")
Is this replicable via the UI, @jomaxro?
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [February 13, 2018, 11:40pm UTC](https://meta.discourse.org/t/cannot-activate-a-user-with-an-unconfirmed-email-token/80431/8 "2018-02-13T23:40:40Z")
Sorry for the delay @pfaffman, travelling this week.
Looks like we’ve got a real bug here. The activate button works if the user has never been activated before (sign up, don’t click on the link in email), however it fails if the user was deactivated.
Repro steps:
1. User signs up on site and activates their account as normal.
2. Admin goes to user admin page and click Deactivate
3. User is logged out.
4. Admin clicks “Activate Account” - the page refreshes but the user is still deactivated.
5. Admin gets annoyed and keeps clicking Activate Account, to no avail 😉.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [February 13, 2018, 11:47pm UTC](https://meta.discourse.org/t/cannot-activate-a-user-with-an-unconfirmed-email-token/80431/9 "2018-02-13T23:47:59Z")
Well, I’ll be!
In that case, the problem appears to have to do with there being an email token has been created. I looked at the code and couldn’t quite see where the problem is.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 14, 2018, 12:13am UTC](https://meta.discourse.org/t/cannot-activate-a-user-with-an-unconfirmed-email-token/80431/10 "2018-02-14T00:13:49Z")
Ok @techapj we should get this fixed. See repro above.. there should be handling of the case where the user was deactivated too.
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [February 14, 2018, 4:04pm UTC](https://meta.discourse.org/t/cannot-activate-a-user-with-an-unconfirmed-email-token/80431/11 "2018-02-14T16:04:21Z")
Fixed via:
[https://github.com/discourse/discourse/commit/f07b1a5c054ab4813cdd1782746fcf84300c036c](https://github.com/discourse/discourse/commit/f07b1a5c054ab4813cdd1782746fcf84300c036c)
Thanks for reporting this issue @pfaffman. 👍
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [February 15, 2018, 12:30pm UTC](https://meta.discourse.org/t/cannot-activate-a-user-with-an-unconfirmed-email-token/80431/12 "2018-02-15T12:30:09Z")
This topic was automatically closed after 20 hours. New replies are no longer allowed.