Non-activated / deactivated users still show in public users page

I’m guessing this is a bug as when you search for a deactivated user they don’t show in search results.

Basically if you go to this page: Discourse Meta and scroll through it, deactivated users show… but if you try to reach for them they don’t show. (You can’t @ them in posts either.)

Would it be best to hide deactivated or not activated users from all public areas? (I think so.)

By non-activated/deactivated members I mean those who haven’t validated their email or those who must re-validate their email.

1 Like

You mean inactive users:

  • You can’t mention them because they aren’t active.
  • You can’t search for them because they aren’t active.

This may be a bug but I don’t think it is:

  • Inactive users are still users in the user table.
  • There is a site setting to allow viewing inactive accounts - off by default but it may be enabled here:
    show inactive accounts
    I wonder if meta.discourse.org shows inactive customer accounts because of hosting customers?
  • There is a setting to delete inactive users if they needed to be removed - the default is two years:
    clean up inactive users after days.
5 Likes

Is off, but they’re still showing.

I’m guessing the behaviour is that they still show in the admin CP, just not publicly. A lot of the time spammers sign up such accounts with urls as name or profile details (sometimes porn, etc)

1 Like

The show inactive accounts site setting is only applied to non-staff users. If the setting is disabled (it’s disabled by default), then regular users will not be able to see the usercard or profile page of deactivated users. Staff users will still be able to see the usercard and profile page though.

The deactivated user will show up in your public user directory whether or not you have disabled the show inactive accounts site setting.

3 Likes

Does this apply to both new unverified members as well as manually deactivated members Simon?

Sometimes spammers/trolls/bad actors sign up accounts with urls as usernames or other profile details.

Would it be easy enough to hide users from the public user directory with a theme component or something? (I’m still reading up on them so not sure myself yet.) I did look at the css but no special class is applied to the row of deactivated members… is this something that could be added please?

1 Like

This is not correct. Deactivated users are not immediately removed from the users directory, but they should be removed when the job that refreshes the user directory is run. That job runs once per day.

The code that adds and removes users from the directory checks that the user is active. This means that inactive users who were once active on your site should be removed from the users directory within one day of their being deactivated. Users who have never been active on your site, for example, a user who signs up and then doesn’t respond to the activation email, should never show up in the users directory.

For sites that have enabled the must approve users site setting, unapproved users will not be added to the users directory.

Let me know if this is not what you are finding on your site.

3 Likes

Ah thanks, that makes sense Simon.

It doesn’t seem to have worked on my dev setup (but I have only be running the server as and when needed) but I have just created a test on a live site so will see how that goes and report back to you :smiley:

1 Like

It worked :smiley: the account disappeared from the list after a day or so.

Quick question regarding manually deactivated users, will they be subject to the same rules as standard un-activated users? Specifically, will they be deleted from the database if they do not reactivate their account within 30 days (which I think is the standard time allowed for a new account to verify their email)?

2 Likes

Good question, @eviltrout can someone check that logic? I know for new signups this is true – because who cares about a new signup if they can’t be bothered to activate their email within 7 days as part of the signup – but not sure about manual deactivation.

2 Likes

I checked the logic and users will be deleted after clean_up_inactive_users_after_days days if:

  • They’ve never posted anything
  • They are TL0
  • They’re not staff

So to answer your question, yes manually deactivated users will be removed, but not if they’ve posted anything or gained any trust levels.

5 Likes