Email/IP checks require password

[ct-337]

When checking someone’s email, IP^[1], or other sensitive info, you should be required to enter your password so you don’t accidentally check anything.

---

1. Whenever a staff member performs an IP lookup on a user, record the action in the Logs and Screening section

   In our forum, we have a few staff members (obviously) that can watch the forum just in case anything bad happens. While I was messing around with the admin controls, I saw an “IP Check” feature. I used it on myself, and it gave me the exact location. I saw that this could be abused, so I went to the Logs and Screening section to see if Discourse itself reports if a staff member has checked someone’s IP. It doesn’t. Here’s a video: Why does Discourse not report it to the Logs? I believe…

   ↩︎