Staff cannot manually activate invited accounts after 48 hours has elapsed

[techAPJ (Arpit Jalan)]

@codinghorror

This seems correct. The only difference is that issuing a password reset or forgot password should work in this case, shouldn’t it?

That is correct, and I verified locally on a copy of Steve’s site that sending forgot password email and following that link (changing password), user is able to regain access to that account.

I provided repro steps just to provide context on how users are ending up with “activated” account, but unable to login the next time they visit. (as described by @Benjamin_Mosior)

There is only one actual issue here, and that is:

@techAPJ

We are only confirming active email tokens (by default: created in last 48 hours), so if the Admin tries to manually deactivate/activate the account after 48 hours the older email tokens are not getting confirmed, only the active field in user account is set to true.

So, admins can’t activate the account (read: confirm email) manually and users (or Admin) will need to trigger forgot password email and change the password to regain access to that account.

Also, if the site setting must approve users is disabled, users can simply click on Resend Activation Email button to regain access. Like in the case of @Benjamin_Mosior site.

TL;DR

So the bug here is: Admin can’t activate the user account manually (after 48 hours of account creation) via User Admin page.