为什么我仍然需要批准我邀请的用户？

[gordon_mrmoco (Gordon)]

我的论坛用户可以被邀请，也可以自行注册，然后我需要批准他们。

以前，如果我邀请了他们，他们只需接受即可。

最近不知何故，即使我邀请了他们，他们也会显示为需要审核和批准的注册用户。

这是为什么？我该如何关闭这个功能？我邀请了他们，所以不希望再单独批准他们。

谢谢

戈登

[simonk (Simon King)]

出于安全原因，已进行此更改：

Staff-generated invites bypass the must_approve_users requirement

We’ve had a serious security issue with the invite system. I guess it’s easily reproducible. Our site is on invite-only. In addition, we have checked “must approve users” in the settings. One of our staff issued an invitation with a max use greater than 1, thus not restricted to one email in particular (example below). [2022-05-26 16_24_30-Profile - Wall-E - Helionauts] That invite link circulated, and people could register with it. Yet we expected that when “must approve users” is checked …

目前没有变通方法：

Allow users invited by staff to skip approval

Yeah … long term solution I guess is to add a site setting that allows for the relaxed approval mode I guess, opt in. I worry though cause getting security right here is very very hard. The more edge cases we allow for, the more complexity and potential security flaws.

[gordon_mrmoco (Gordon)]

非常感谢您的信息！