# Require email activation before Admin approval

**URL:** https://meta.discourse.org/t/require-email-activation-before-admin-approval/41843
**Category:** Feature
**Created:** [3월 31, 2016, 8:46오후 UTC](https://meta.discourse.org/t/require-email-activation-before-admin-approval/41843 "2016-03-31T20:46:43Z")
**Posts on this page:** 1
**Showing post:** 6

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [1월 2, 2019, 9:46오전 UTC](https://meta.discourse.org/t/require-email-activation-before-admin-approval/41843/6 "2019-01-02T09:46:07Z")

</div>

I think this already got changed:

> [@Change email after registering and pending activation?](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/16):
>
> The issue here is someone doesn’t ever want users to change their emails, and they were allowed to do so following approval if they hadn’t activated their original email. It doesn’t seem like a security hole to me since the user still had the authenticate the email, but I understand in some rare situations forum owners don’t want users to change their emails. The solution is what’s suggested earlier: don’t allow staff to approve a user until they’ve confirmed their email address. [https://githu…](https://github.com/discourse/discourse/commit/db929e58fc02923ddc2d09add5103aaba73c027f)

> [@codinghorror](#):
>
> Until you’ve decided whether they are allowed, email validity does not matter.

The issue here is when people use the email to identify someone. If I see someone sign up as `jeff@discourse.org` on my forum, I could click “approve”, and then they could swap out the email address with something else.

---

_[View the full topic](https://meta.discourse.org/t/require-email-activation-before-admin-approval/41843)._