Require email activation before Admin approval

[david (David Taylor)]

I think this already got changed:

Change email after registering and pending activation?

The issue here is someone doesn’t ever want users to change their emails, and they were allowed to do so following approval if they hadn’t activated their original email. It doesn’t seem like a security hole to me since the user still had the authenticate the email, but I understand in some rare situations forum owners don’t want users to change their emails. The solution is what’s suggested earlier: don’t allow staff to approve a user until they’ve confirmed their email address. https://githu…

@codinghorror

Until you’ve decided whether they are allowed, email validity does not matter.

The issue here is when people use the email to identify someone. If I see someone sign up as jeff@discourse.org on my forum, I could click “approve”, and then they could swap out the email address with something else.