It seems that this feature is a great opportunity for people to impersonate others using another domain name.
I register with @coolcompany.com
I get the “change email address” button when registering but pending activation.
I wait a few hours with that window open (or maybe a few minutes) until I get approved, you never know, maybe they are super effective.
I click change my email address, and I basically can put whatever there, but I am already approved!
The admin does not get a "@coolcompany.com has not activated, and @another.com is pending", no, instead, I have approved someone I thought it was from @coolcompany.com, but actually it was just using that domain to get approved, as I don’t get another pending approval item.
Is this by design? is it a bug? I could not find a topic like this in the forums.
My big question is, can I deactivate this feature? I honestly don’t want it.
Doesn’t the signup with @coolcompany need to confirm control of the email address? Or does that happen after the approval? Confirmation should happen for all email addresses.
Stops on the screen when he can change his email (pending approval)
I go to the admin panel, approve him (as I see he is a good fella from @coolcompany.com)
He then proceeds to change his email on that screen clicking the “change email address” grey button.
He gets a “new” confirmation email to his NEW INSERTED email address, and validates his NEW address.
He is now approved, and into the forums.
When I go to see the list of users, he now has another email! I mean, I am not going to check everybody’s emails once a week just to check if they did not do that. I have already approved someone based on the initial information they provided, presuming they CANNOT change it afterwards (I have disabled the option to change their emails in the future).
But I am REALLY interested in disabling this feature we are talking about here.
I think I’ve seen this before on my instance - isn’t really an issue for us though as we don’t care what email address people use. Just repro-d it successfully on tests-passed.
Just in case there’s any confusion about active vs. approved. As I understand it:
“active” is related to verifying your own email address
“approved” is when a staff member approves a user (with must approve users site setting)
I think @fermelone is talking about this scenario, which I can reproduce:
User signs up, but does not “activate”
Staff member sees new user, and clicks “approve” after looking at their (un-activated) email address
User uses “update activation email” to change email address
User can now activate an account
So maybe users shouldn’t be added to the approval queue until they are ‘activated’?
I believe this was discussed early on, the chicken and egg problem between the admin approving first, or the user validating their email first. They definitely should not show up as approve-able until they validate their email though.
The issue here is someone doesn’t ever want users to change their emails, and they were allowed to do so following approval if they hadn’t activated their original email. It doesn’t seem like a security hole to me since the user still had the authenticate the email, but I understand in some rare situations forum owners don’t want users to change their emails.
The solution is what’s suggested earlier: don’t allow staff to approve a user until they’ve confirmed their email address.
