A security concern was raised regarding the ability to change email addresses after registering but before activation, potentially allowing users to impersonate others. fermelone demonstrated this vulnerability and asked how to disable the feature.
@pfaffman suggested that a site setting could prevent users from changing their email addresses. However, it was later revealed that the issue was more complex, particularly when mandatory account approvals are enabled.
@codinghorror and @david pointed out that the problem arises when a staff member approves a user before they have activated their email address. They suggested that users should not be added to the approval queue until they have confirmed their email address.
@sam agreed with this proposal, which would also reduce noise in the approval queue. The issue has been addressed, and the solution is to not allow staff to approve users until they have confirmed their email address. Eviltrout has implemented this fix.
It seems that this feature is a great opportunity for people to impersonate others using another domain name.
I register with @coolcompany.com
I get the “change email address” button when registering but pending activation.
I wait a few hours with that window open (or maybe a few minutes) until I get approved, you never know, maybe they are super effective.
I click change my email address, and I basically can put whatever there, but I am already approved!
The admin does not get a “@coolcompany.com has not activated, and @another.com is pending”, no, instead, I have approved someone I thought it was from @coolcompany.com, but actually it was just using that domain to get approved, as I don’t get another pending approval item.
Is this by design? is it a bug? I could not find a topic like this in the forums.
My big question is, can I deactivate this feature? I honestly don’t want it.
Doesn’t the signup with @coolcompany need to confirm control of the email address? Or does that happen after the approval? Confirmation should happen for all email addresses.
Stops on the screen when he can change his email (pending approval)
I go to the admin panel, approve him (as I see he is a good fella from @coolcompany.com)
He then proceeds to change his email on that screen clicking the “change email address” grey button.
He gets a “new” confirmation email to his NEW INSERTED email address, and validates his NEW address.
He is now approved, and into the forums.
When I go to see the list of users, he now has another email! I mean, I am not going to check everybody’s emails once a week just to check if they did not do that. I have already approved someone based on the initial information they provided, presuming they CANNOT change it afterwards (I have disabled the option to change their emails in the future).
But I am REALLY interested in disabling this feature we are talking about here.
I think I’ve seen this before on my instance - isn’t really an issue for us though as we don’t care what email address people use. Just repro-d it successfully on tests-passed.
Just in case there’s any confusion about active vs. approved. As I understand it:
“active” is related to verifying your own email address
“approved” is when a staff member approves a user (with must approve users site setting)
I think @fermelone is talking about this scenario, which I can reproduce:
User signs up, but does not “activate”
Staff member sees new user, and clicks “approve” after looking at their (un-activated) email address
User uses “update activation email” to change email address
User can now activate an account
So maybe users shouldn’t be added to the approval queue until they are ‘activated’?
I believe this was discussed early on, the chicken and egg problem between the admin approving first, or the user validating their email first. They definitely should not show up as approve-able until they validate their email though.
The issue here is someone doesn’t ever want users to change their emails, and they were allowed to do so following approval if they hadn’t activated their original email. It doesn’t seem like a security hole to me since the user still had the authenticate the email, but I understand in some rare situations forum owners don’t want users to change their emails.
The solution is what’s suggested earlier: don’t allow staff to approve a user until they’ve confirmed their email address.
