Only admin account went 'approval pending' overnight

(Stephen) #1

Scratching my head on this one.

Overnight another staff member received an email telling them that there was a user to approve on one of our closed invite-only instances. The user account in question was mine, the only admin account on the instance.

v2.0.0.beta9 +51

Would the actions which led up to this have been logged anywhere? How can an admin user lose approval like that?

(Simon Cossar) #2

If you have enabled the ‘must approve users’ setting, staff accounts, including the account that enabled the setting, will show up in the Pending Users list. Your being on the Pending Users list could trigger the pending users reminder notification for other staff members.

When the ‘must approve users’ setting is enabled, unapproved staff members can still login and use the forum normally.

(Stephen) #3

Thanks Simon, I understand user approval and have corrected the setting, I’m just trying to figure out why the first user on the install is the only one which went approval pending.

The others were all invited over the past eight months, didn’t require approval when they accepted their invites and didn’t get caught overnight when mine needed to be approved.

Did something change in the criteria for approvals?
Was an admin created by rake admin:create previously overlooked?
Do invites bypass the approval process?

(Simon Cossar) #4

Yes, invites by staff bypass the approval process. When the must approve user setting is enabled, only staff can invite a new user to the forum.

I’m not aware of any recent changes to the approval process.

(Stephen) #5

It sounds as though something has changed in the past 24hrs as must_approve_users was originally set to TRUE in September of 2017, and the account was flagged eight months later.

(Jeff Atwood) #6

I think this did change recently so invites go through the approval pipeline? cc @Simon_Cossar – my memory is hazy but a meta or github search might provide more info.

(Simon Cossar) #7

I searched the forum and didn’t find an answer, so I tried it out. When the must approve users setting is enabled, only mods and admins can invite new users to the forum. Users invited in this way are not added to the Pending Users list. If you visit the Admin/User page for an invited user, you will see that the user was approved by the staff member who sent the invite.

When the must approve users setting is enabled, the invite button is still displayed for regular users below topics, but there is only an option to invite existing users to the topic. New users can’t be invited.

The issue with the pending_users_reminder notification being sent for an admin user 7 months after the setting was enabled is a bit of a mystery. The only way that it should happen would be if the moderator who had received the notification hadn’t checked their notifications for 7 months.

(Stephen) #8

The user who received the pending users message is only a moderator.

The user they were asked to approve is an admin, the first user on the install and one who was created using rake.

(Simon Cossar) #9

Yes, that notification is only sent to moderators, not to admins. It shouldn’t matter how the admin user was created. The admin who enables the ‘must approve users’ setting will always be added to the Pending Users list. That probably shouldn’t happen - being a Pending User has no affect on mods or admins.

If you have recently disabled and then re-enabled the must approve users setting, that would cause the notification about any pending users to be sent again.