# Required checkbox field can be bypassed
**URL:** https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962
**Category:** Feature
**Created:** [August 29, 2017, 12:00am UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962 "2017-08-29T00:00:03Z")
**Posts on this page:** 18
**Page:** 1
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [August 29, 2017, 12:00am UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/1 "2017-08-29T00:00:03Z")
While creating a test user the other day via google auth, I noticed that I was able to create the user even though I did not fill in (tick) the custom user field that is required at sign-up.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 29, 2017, 12:00am UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/2 "2017-08-29T00:00:43Z")
Sorry I am unclear here. Can you list the exact repro steps please?
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [August 29, 2017, 12:12am UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/3 "2017-08-29T00:12:29Z")
If memory serves:
1. Make sure you have Google Auth as an option for creating new user avcount.
2. Create a custom user field (type: confirmation) and set it to “Required at signup”.
3. Access the sign-up page as an unknown user and use the Google button to fill in the “Create New Account” form
4. _Don’t_ tick the checkbox of the required custom user field
5. The “Create New Account” button is not greyed out and works to create the account (despite the required field not being checked).
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 29, 2017, 12:26am UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/4 "2017-08-29T00:26:21Z")
So this is specific to checkbox? Does it happen with text fields as well?
Wait a second. Checkboxes are only checked or unchecked. How can you even _tell_ if someone “didn’t” fill it in? This is a logical fallacy. There is no third “not-checked-or-unchecked” state here.
---
### Author:  [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [August 29, 2017, 1:23am UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/5 "2017-08-29T01:23:06Z")
> [@codinghorror](#):
>
> Wait a second. Checkboxes are only checked or unchecked. How can you even tell if someone “didn’t” fill it in? This is a logical fallacy. There is no third “not-checked-or-unchecked” state here.
When checkboxes are for things like “I agree to the [Terms of Service](https://terms.of.service/)”, the only state that matters is “checked”. Any other value should be no-go.
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [August 29, 2017, 5:43am UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/6 "2017-08-29T05:43:21Z")
> [@codinghorror](#):
>
> So this is specific to checkbox? Does it happen with text fields as well?
I mentioned checkbox because that is my scenario. I didn’t check other user field types but it seems improbable to me that the code that checks required user fields would be bypassed only in the case of one type of user field.
Could you explain why you changed the category for this bug report to feature? Are you suggesting that required user fields are _supposed to be_ required only for the ordinary sign-up method?
> [@elijah](#):
>
> When checkboxes are for things like “I agree to the Terms of Service”, the only state that matters is “checked”. Any other value should be no-go.
Yes, that is how it works for sign-up without social login.
---
### Author:  [@pain](https://meta.discourse.org/u/pain)
#### Post date: [August 29, 2017, 6:20am UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/7 "2017-08-29T06:20:54Z")
> [@elijah](#):
>
> When checkboxes are for things like “I agree to the Terms of Service”, the only state that matters is “checked”. Any other value should be no-go.
by signing up they agree to tos as per default tos that comes with discourse
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 29, 2017, 11:32am UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/8 "2017-08-29T11:32:01Z")
Please read my reply. That explains what I said. Can you explain what state you expect the checkbox to be in? In other words, can you provide a real live example with actual values?
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [August 29, 2017, 12:30pm UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/9 "2017-08-29T12:30:09Z")
> [@codinghorror](#):
>
> Can you explain what state you expect the checkbox to be in?
The state of the checkbox is not an expected result but a condition:
> [@tophee](#):
>
> Don’t tick the checkbox of the required custom user field
The expectation is that required user fields will work the same regardless of which method a new user uses to sign up, i.e. in the case of a check box, that the user cannot sign-up as long as the required check box is not ticked.
> [@codinghorror](#):
>
> can you provide a real live example with actual values?
Here you go:
> [@tophee](#):
>
> Make sure you have Google Auth as an option for creating new user avcount.
> Create a custom user field (type: confirmation) and set it to “Required at signup”.
> Access the sign-up page as an unknown user and use the Google button to fill in the “Create New Account” form
>
> Don’t tick the checkbox of the required custom user field
> The “Create New Account” button is not greyed out and works to create the account (despite the required field not being checked).
What else do you need?
* * *
> [@pain](#):
>
> by signing up they agree to tos as per default tos that comes with discourse
I think it was meant as an example:
> [@elijah](#):
>
> things like
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 29, 2017, 12:43pm UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/10 "2017-08-29T12:43:42Z")
What is the actual checkbox text on the screen? Can you share a screenshot?
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [August 29, 2017, 2:04pm UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/11 "2017-08-29T14:04:11Z")
How would that text (i.e. the field description) have anything to do with the technical issue here?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 29, 2017, 2:14pm UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/12 "2017-08-29T14:14:01Z")
Are you requiring that the box be checked, as in “did you read the terms of service”? There’s no other way this can work. There’s only one state you can have – checked.
Therefore the text is quite relevant.
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [August 29, 2017, 2:35pm UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/13 "2017-08-29T14:35:53Z")
I think we are somehow talking past each other: The bug I’m reporting is no more and no less than that required user fields seem to work differently when a social login is used as opposed to manually filling in your email etc. I consider this a bug because I think it makes no sense that required user fields are not required if you use a different authentication method. In other words, I’m assuming that what I’m seeing is unintentional (while you seem to be implying that it is intentional?):
If a new user signs up by manually entering their email, username and password, the “Create New User” button will be greyed out and ineffective until the user checks the checkbox of the required custom user field. This is expected behaviour and everything is fine with that.
Now, if a new user clicks on the “Google” button instead of the above method, the sign-up form will be filled in automatically once s/he returns from the Google Auth page. This is also fine and as expected. What is not fine is that even though the custom user field checkbox has not been ticked, the “Create New User” button is _not_ greyed out and fully functional. In other words, the user can create a new user while ignoring the required custom user field. This should not be possible and this is the issue that I’m reporting here.
To be clear: I am talking about signing up via the `/signup` modal.
---
### Author:  [@pain](https://meta.discourse.org/u/pain)
#### Post date: [August 30, 2017, 4:06am UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/14 "2017-08-30T04:06:41Z")
i get what you’re saying, btw, do you have Required at signup ticked?
EDIT:
> [@tophee](#):
>
> even though I did not fill in (tick) the custom user field that is required at sign-up.
you’re going to have to tick it for it to not be “bypassed”
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [August 30, 2017, 5:21am UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/15 "2017-08-30T05:21:03Z")
> [@pain](#):
>
> do you have Required at signup ticked?
Yes, of course. And it works fine when creating a new user the “ordinary” way.
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [September 14, 2017, 7:57am UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/16 "2017-09-14T07:57:49Z")
Any chance that this will be fixed?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [September 21, 2017, 2:34am UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/17 "2017-09-21T02:34:54Z")
Can you share some screenshots please, it does sound like a bug to me.
---
### Author:  [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [September 21, 2017, 7:30pm UTC](https://meta.discourse.org/t/required-checkbox-field-can-be-bypassed/68962/18 "2017-09-21T19:30:30Z")
Here you go:
So, just to be explicit: the above screenshot shows that, if I use Google Auth I can create a new account without accepting the required custom user field.
By contrast, if I go the ordinary route and fill in my details manually, the “Create New Account” button remains greyed out:
… until I fill in/acccept the custom user field:
