# Require mail confirmation to grant admin privileges
**URL:** https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164
**Category:** Feature
**Created:** [30 Março , 2017 09:05 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164 "2017-03-30T09:05:47Z")
**Posts on this page:** 16
**Page:** 1
### Author:  [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [30 Março , 2017 09:05 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164/1 "2017-03-30T09:05:47Z")
Currently, [downloading a backup requires clicking a link in an email as a second factor of authentication](https://meta.discourse.org/t/security-breach-in-discourse-forum-with-sso/55759/27). This is awesome! 💯
I’d like to also see that when granting another user admin privileges.
Without this, I don’t really see the point in confirmation before downloading a backup: Assuming an attacker hijacked an admin’s session, couldn’t he simply sign up a new account with an email address he controls, grant admin privileges to that user, and then use _that_ user to download the backup?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [30 Março , 2017 09:32 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164/2 "2017-03-30T09:32:33Z")
@fefrei are you … are you .. thinking outside the box again? _Get back inside that box at once!_
How do you envision this working, exactly?
---
### Author:  [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [30 Março , 2017 09:36 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164/3 "2017-03-30T09:36:53Z")
Hey, I’m claustrophobic! 😜
The new behavior would simply be:
1. An admin clicks on Grant Admin.
2. He’s shown a message saying _We’ve sent you an email to confirm this action. Please click the link inside this email to grant administrative privileges to `@username`._
3. He gets an email, clicks the link in it, goes through a JavaScript-button to prevent accidental “clicks” (just as with the activation link), and boom, `@username` has admin privileges 🙂
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [4 Abril , 2017 20:07 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164/4 "2017-04-04T20:07:21Z")
Great suggestion. I’ve implemented it here:
[https://github.com/discourse/discourse/commit/17f2974d0a99a6c38b1aa90abe68c9f8b69dc567](https://github.com/discourse/discourse/commit/17f2974d0a99a6c38b1aa90abe68c9f8b69dc567)
I basically implemented it as you suggested, except there is no Javascript button as we do for account activation. That was meant to prevent bots from signing up and I don’t think it’s necessary in this case. It still shows you a HTML form with a button though to prevent email clients from crawling emails and activating the admin though.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [5 Abril , 2017 02:16 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164/5 "2017-04-05T02:16:47Z")
Ok! This covers the two critical cases for admins:
1. Download db
2. Grant admin
Both require email verification now. Thanks for that @eviltrout.
---
### Author:  [@downey](https://meta.discourse.org/u/downey)
#### Post date: [21 Setembro , 2017 16:31 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164/6 "2017-09-21T16:31:09Z")
I’m curious about the rationale of this change. What does adding additional steps, which require external dependencies (email) actually accomplish here?
Case in point: We have a dev server with problems getting emails out. Trying to add an admin account to do troubleshooting, but I can’t do so because adding an admin requires email be working. 🤯
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [21 Setembro , 2017 18:49 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164/7 "2017-09-21T18:49:43Z")
Pretty much what is described in the first post? I don’t know what @fefrei could add to make it more clear?
---
### Author:  [@downey](https://meta.discourse.org/u/downey)
#### Post date: [21 Setembro , 2017 19:06 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164/8 "2017-09-21T19:06:14Z")
Doesn’t someone signed in as an admin user already have full access to the site’s configuration & content, and control over all user accounts?
If the above answer is yes, I guess I’m still not sure what security benefit is achieved by sticking email in the middle of the process. I may certainly be missing something though…
---
### Author:  [@MakaryGo](https://meta.discourse.org/u/MakaryGo)
#### Post date: [21 Setembro , 2017 19:08 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164/9 "2017-09-21T19:08:36Z")
By the way, link in the e-mail is broken, dunno if it’s translation dependent?
Edit: Found it, translation issue indeed. Do I have to correct it via Transifex?
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [21 Setembro , 2017 19:10 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164/10 "2017-09-21T19:10:24Z")
> [@downey](#):
>
> We have a dev server with problems getting emails out. Trying to add an admin account to do troubleshooting, but I can’t do so because adding an admin requires email be working.
Brief aside, do you have SSH/console access? [Create an admin account from the console](https://meta.discourse.org/t/create-admin-account-from-console/17274)
---
### Author:  [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [21 Setembro , 2017 23:23 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164/11 "2017-09-21T23:23:14Z")
An admin does not have the ability to get to hashed user passwords without mail confirmation now. That’s a good thing 🙂
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [22 Setembro , 2017 16:14 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164/12 "2017-09-22T16:14:53Z")
Speaking of getting hashed user passwords…
How about creating a second database role for the [Data Explorer](https://meta.discourse.org/t/32566?silent=true)?
```plaintext
grant select on #{database} to discourse_data_explorer;
revoke select password_hash, auth_token on users from discourse_data_explorer;
# repeat for other sensitive columns
#in data explorer execute:
Begin;
Set read only blah blah;
Set local role discourse_data_explorer;
```
(Note that this doesn’t actually work, revokes undo grants and can’t carve out of them)
---
### Author:  [@downey](https://meta.discourse.org/u/downey)
#### Post date: [26 Setembro , 2017 21:20 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164/13 "2017-09-26T21:20:33Z")
> [@fefrei](#):
>
> An admin does not have the ability to get to hashed user passwords without mail confirmation now.
OK, I understand it from a security/engineering perspective as some type of hypothetical ideal, but **my comments reflect an actual user telling y’all that the UX is very bad for folks trying to migrate sites** between servers. :sadpanda:
We disable email when doing migrations so notifications don’t go out inadvertently. These changes that require email to be enabled (a third-party dependencies to be working!) make it difficult-to-impossible for adding users or dealing with backups during that time, not to mention make it impossible to get your site out of a “broken email” scenario.
Now pardon me while I go back to pulling my hair out… 😉
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [26 Setembro , 2017 22:23 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164/14 "2017-09-26T22:23:28Z")
Security is what it is. If you don’t want security, choose something else..
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [28 Dezembro , 2017 00:43 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164/15 "2017-12-28T00:43:14Z")
Wow, how long can we keep this open, was implemented quite a few posts up. Keeping this open is super confusing.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [28 Dezembro , 2017 00:43 UTC](https://meta.discourse.org/t/require-mail-confirmation-to-grant-admin-privileges/60164/16 "2017-12-28T00:43:17Z")