초대한 사용자를 왜 다시 승인해야 하나요?

[simonk (Simon King)]

보안상의 이유로 이 부분이 변경되었습니다:

스태프가 생성한 초대 링크가 must_approve_users 요구 사항을 우회합니다

We’ve had a serious security issue with the invite system. I guess it’s easily reproducible. Our site is on invite-only. In addition, we have checked “must approve users” in the settings. One of our staff issued an invitation with a max use greater than 1, thus not restricted to one email in particular (example below). [2022-05-26 16_24_30-Profile - Wall-E - Helionauts] That invite link circulated, and people could register with it. Yet we expected that when “must approve users” is checked …

현재 우회 방법은 없습니다:

스태프가 초대한 사용자는 승인 절차 생략 허용

Yeah … long term solution I guess is to add a site setting that allows for the relaxed approval mode I guess, opt in. I worry though cause getting security right here is very very hard. The more edge cases we allow for, the more complexity and potential security flaws.