# Change email after registering and pending activation?
**URL:** https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243
**Category:** Bug
**Created:** [August 17, 2017, 3:02pm UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243 "2017-08-17T15:02:05Z")
**Posts on this page:** 17
**Page:** 1
### Author:  [@fermelone](https://meta.discourse.org/u/fermelone)
#### Post date: [August 17, 2017, 3:02pm UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/1 "2017-08-17T15:02:05Z")
Hello,
It seems that this feature is a great opportunity for people to impersonate others using another domain name.
1. I register with @coolcompany.com
2. I get the “change email address” button when registering but pending activation.
3. I wait a few hours with that window open (or maybe a few minutes) until I get approved, you never know, maybe they are super effective.
4. I click change my email address, and I basically can put whatever there, but I am already approved!
The admin does not get a “@coolcompany.com has not activated, and @another.com is pending”, no, instead, I have approved someone I thought it was from @coolcompany.com, but actually it was just using that domain to get approved, as I don’t get another pending approval item.
Is this by design? is it a bug? I could not find a topic like this in the forums.
My big question is, can I deactivate this feature? I honestly don’t want it.
Thanks!
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [August 17, 2017, 4:29pm UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/2 "2017-08-17T16:29:53Z")
There is a site setting that keeps users from being able to change their email address. Will that help?
---
### Author:  [@fermelone](https://meta.discourse.org/u/fermelone)
#### Post date: [August 17, 2017, 5:08pm UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/3 "2017-08-17T17:08:11Z")
Of course! I mean, my post has 2 goals:
- Letting you guys that this seems like a good way to impersonate people
- Find out how to disable this.
@pfaffman how do I disable it?
---
### Author:  [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [August 17, 2017, 5:25pm UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/4 "2017-08-17T17:25:00Z")
Doesn’t the signup with @coolcompany need to confirm control of the email address? Or does that happen after the approval? Confirmation should happen for all email addresses.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 17, 2017, 11:07pm UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/5 "2017-08-17T23:07:40Z")
> [@fermelone](#):
>
> I click change my email address, and I basically can put whatever there, but I am already approved!
Yeah this seems like a bug in the feature – @eviltrout worked on it, can you confirm this does not work Robin because I don’t think it should.
Once the user has confirmed their email, that function should no longer work.
This is basically a security exploit so I think handling it should be prioritized.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [August 18, 2017, 12:22am UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/6 "2017-08-18T00:22:21Z")
I just tried to reproduce this and got an error from the server: **You are not permitted to view the requested resource.**
The URL makes a request to `/u/update-activation-email`. I confirmed in the source code that if a user is already active that it raises an error:
>
Are you 100% sure you were able to change the email address following the above steps? Because I am not able to.
---
### Author:  [@fermelone](https://meta.discourse.org/u/fermelone)
#### Post date: [August 18, 2017, 10:41am UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/7 "2017-08-18T10:41:12Z")
@eviltrout Yes! just tried it again.
Basically I tried it with a teammate.
1. He signs up, writes the @coolcompany.com email.
2. Stops on the screen when he can change his email (pending approval)
3. I go to the admin panel, approve him (as I see he is a good fella from @coolcompany.com)
4. He then proceeds to change his email on that screen clicking the “change email address” grey button.
5. He gets a “new” confirmation email to his NEW INSERTED email address, and validates his NEW address.
6. He is now approved, and into the forums.
7. When I go to see the list of users, he now has another email! I mean, I am not going to check everybody’s emails once a week just to check if they did not do that. I have already approved someone based on the initial information they provided, presuming they CANNOT change it afterwards (I have disabled the option to change their emails in the future).
But I am REALLY interested in disabling this feature we are talking about here.
Thanks!
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [August 18, 2017, 10:50am UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/8 "2017-08-18T10:50:03Z")
Just making sure, what version of Discourse are you running?
---
### Author:  [@fermelone](https://meta.discourse.org/u/fermelone)
#### Post date: [August 18, 2017, 10:51am UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/9 "2017-08-18T10:51:24Z")
Trial of Std version, cloud, hosted by Discourse 🙂
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 18, 2017, 10:59am UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/10 "2017-08-18T10:59:24Z")
> [@fermelone](#):
>
> go to the admin panel, approve him
This seems to be the main difference, you have mandatory account approvals enabled, not default out of box signup?
So disable that on your site, since it seems to be the source of the issue.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [August 18, 2017, 11:00am UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/11 "2017-08-18T11:00:26Z")
I think I’ve seen this before on my instance - isn’t really an issue for us though as we don’t care what email address people use. Just repro-d it successfully on tests-passed.
Just in case there’s any confusion about active vs. approved. As I understand it:
- “active” is related to verifying your own email address
- “approved” is when a staff member approves a user (with `must approve users` site setting)
I think @fermelone is talking about this scenario, which I can reproduce:
- User signs up, but does not “activate”
- Staff member sees new user, and clicks “approve” after looking at their (un-activated) email address
- User uses “update activation email” to change email address
- User can now activate an account
So maybe users shouldn’t be added to the approval queue until they are ‘activated’?
---
### Author:  [@fermelone](https://meta.discourse.org/u/fermelone)
#### Post date: [August 18, 2017, 11:02am UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/12 "2017-08-18T11:02:58Z")
@codinghorror I get your point, but I want to control who accesses and registers to my forum.
@david I like David’s idea, once they confirmed the email that they cannot change, then show me I have a pending approval. I like this one.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [August 18, 2017, 11:19am UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/13 "2017-08-18T11:19:21Z")
> [@david](#):
>
> So maybe users shouldn’t be added to the approval queue until they are ‘activated’?
Absolutely, this also cuts down noise in the approve users queue, should be our default behavior, not sure you should even be allowed to disable
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 18, 2017, 11:21am UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/14 "2017-08-18T11:21:48Z")
I believe this was discussed early on, the chicken and egg problem between the admin approving first, or the user validating their email first. They definitely should not show up as approve-able until they validate their email though.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 21, 2017, 6:13pm UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/15 "2017-08-21T18:13:54Z")
Are you able to repro this now @eviltrout?
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [September 4, 2017, 4:58pm UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/16 "2017-09-04T16:58:31Z")
The issue here is someone doesn’t ever want users to change their emails, and they were allowed to do so following approval if they hadn’t activated their original email. It doesn’t seem like a security hole to me since the user still had the authenticate the email, but I understand in some rare situations forum owners don’t want users to change their emails.
The solution is what’s suggested earlier: don’t allow staff to approve a user until they’ve confirmed their email address.
>
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [September 10, 2017, 1:12am UTC](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/17 "2017-09-10T01:12:27Z")
This topic was automatically closed after 5 days. New replies are no longer allowed.