비활성화된 사용자에게 이메일을 보내야 할까요?

I am searching for a way to force an email revalidation of users. I saw
image, in the user page and did a test. When attempting to log in the test gave me a response of

but no email to that address to re-validate, only change.

Should the Deactivated user have received an email alerting them that they need to revalidate?

When you manually deactivate a user it doesn’t automatically send an email asking them to revalidate, though you can press the button that appears in their user/admin page to resend one.

When an inactive account attempts to login they should be prompted with a screen like this where they can choose to have a fresh one sent:

I’m not sure why your screenshot seems to be missing that option? :thinking: Could it be some custom code you’ve added to hide a particular button that has also accidentally hidden this one? Does it show up in safe mode?

Edit: After a little bit of digging, I think it’s the must approve users setting that makes the box disappear. When I enable that I no longer get the option showing up:

I’m not 100% sure that’s intentional. :thinking:

1개의 좋아요

의도적으로 보이기倒是는 합니다:

다만 수동적으로 사용자를 비활성화할 때 재검증(revalidation) 흐름도 깨뜨리므로 여전히 버그로 보입니다.

#contribute:bug으로 넘겨서 더 잘 아는 누군가가 판단하도록 하겠습니다. :+1: :slight_smile:

4개의 좋아요

To recap:

  • The community is invite only and every new member must be approved by staff
  • You want to force email re-validation on some users.
  • Given must_approve_users is invite_only and login_required the option for re-sending activation email is missing.

Some observations:

  • the interplay of the 3 settings is a bit confusing. Why would you want must_approve_users if you are already an invite_only community?

  • must_approve_users blocking email approval is somewhat confusing, we should revisit.

Leaving this with the staff-experience team to triage. Expect a response this week.

@benjamincfarmer does it make sense to try must_approve_users off on your community given it is already invite only?

How is invite only connected to this?

When I disable a user, the resend activation email button is missing because must approve users is enabled. Invite only isn’t enabled on my forum.

Yeah I agree it is unrelated, but the particular forum in question does not appear to need must approve users cause it is invite only anyway.

1개의 좋아요

I can understand that you use both, so users with a certain trust level can invite others, but staff can still control who joins the community. I would expect fewer sign-ups by spammers, so less work for staff.

1개의 좋아요

The context for the change appears to be:

So “must approve users” relies on “admins” to actually do the email validation.

My gut here is that the change to fix is rather complex.

  • Must approve users - should only get users that have validated emails
  • Hence even if this setting is enabled we should validate emails first prior to passing on users to admins

Which would be a major rework of this feature. Not against this by any means but it feels somewhat complex.

That topic was created in September 2017.

This was committed in May, so before the topic was created.

Isn’t that the case?
When I sign up a new user:

  1. I fill in the registration form
  2. Then I am asked to validate the email address
  3. When I open the link sent by email, I click to activate the account
  4. I am told that I need to wait for staff to review my registration.

    At this point, the sign-up appears in the review queue, and staff can approve the user, who then receives the email that they can log in.
1개의 좋아요

The root desire of account deactivation was to prune accounts of individuals who no longer have access to their original sign-up email address. After observing that you can move the account to a new address when the account is deactivated I’ve realized that this wouldn’t provide the effect we were looking for anyways.

Sorry for kicking the beehive @sam

Our forum is being used to provide support to our sales agencies. If one of these employees leaves, and goes to a competitor, we want to remove them from the system. Feedback from the agency would be the best way to do this, if I had faith they would tell me.

1개의 좋아요

Thank you for explaining the problem. One option would be deleting the user, but I assume you would like to keep old posts.

The second option would be to anonymize the user. That would prevent them from logging in again, and you will keep all conversations (under an anonymized username).

However, if you would like to keep their original username, we would need to develop a new button called “disapprove.” We would place it here:

If a “disapproved” user tries to log in, they would see this screen:

Would the anonymize feature work for you? It might take us a moment to develop that “disapprove” feature.

1개의 좋아요

Hi all,

We have a very similar need that I also thought “Deactivate User” might support, but found the same thing - Deactivate doesn’t trigger a reactivation email, or even allow the user to re-send the email because we are a private, approval required forum.

Our use case is that we allow people with from a specific group of public sector employers to join a community, as proven by their email address. We are looking to do some kind of periodic re-verification that they are still with the employer by forcing re-activation of the account, so that they cannot log in with existing credentials for very long if they leave their employer and their email account is deactivated.

I’m not looking for account archival tools at this time - the ones that are there will work - the flow I’m wondering about and concerned about is how to basically reach out to all users and say “hey, are you still at the same email address?” and have them be required to verify it, without the ability to change the email address on the approved account. I think we could reset the the passwords, and they’d need access to the email account to reset their password, but that’s a bit higher of a burden on people than clicking the link and could drive some people away.

If there’s a better way to achieve this kind of periodic reverification, I’m open to it, whether that’s in the UI, or some use of the APIs to manually trigger new verification tokens and emails.

Thank you!

3개의 좋아요

이것이 의도된 것인지 확인되었나요? 그렇다면 #contribute:bug에서 다른 곳으로 옮기는 것이 좋을 것 같습니다. (누군가 이유를 알려주신다면 그것도 궁금합니다 :slight_smile:)

의도된 것이라면 여기에는 최소한 두 가지 Contribute > UX/#contribute:feature 문제가 있는 것 같습니다:

  • 사용자가 빠질 수 있는 이 ‘막다른 골목’ 재확인 상황을 부드럽게 처리하는 UX 개선
  • 사용자가 비인가된 이메일로 단순히 전환하여 사이트에 계속 접근하지 못하도록, 이메일 재검증을 주기적으로 강제할 수 있는 방법 제공
1개의 좋아요