As designed Approval Queue: From Waiting For Approval to Waiting

[Evaelis]

Affected version

2.1.5

Hello,

In the approval queue, the following code is used when approving a user (actionApprove):

$user->user_state = 'valid';

Unfortunately, this behavior does not work well when using a registration filter like StopForumSpam. The user will get to the approbation queue without having his e-mail confirmed. And if you want to approve the user, then his e-mail will get validated. Unless you're an administrator, there is no way to use the forum to approve the user e-mail.

Steps to reproduce:

• Enable SFS
• Create an account with an email like example@gmail.comm
• Account gets blocked by SFS
• Approve the account
• The account is now valid as if the user has verified his e-mail address

I don't think it's fair to assume that moderators are able to do e-mail validation manually (sending an email to the user, then what?), especially on big boards. Administrators can reset the validation status but it does require them to use the admin panel

The scenario I would expect is (and the scenario my moderators thought it was):

• Create an account with an email like example@gmail.comm
• Account gets blocked by SFS
• Approve the account (maybe check a box "force e-mail validation" or enable an option like this in the admin panel)
• Account is now in waiting for email confirmation
• User confirms his email
• The account is now valid as if the user has verified his e-mail address

I'm unsure if this qualifies as a bug (Moderators expect the user to be verified as any other after approval) or a feature request but I hope it is the right forum to post this.
I did not find any thread talking about this.
Is this "as intended"? Is there any way to approve a user and send him a confirmation email at the same time?

Best regards,

 

[Mike]

This is known. Not exactly "as designed", but something we've considered as an acceptable compromise to do full spam checking during registration (without changing further flow processes). It's not something we intend on adjusting at this point, as percentage wise, it should only trigger a small number of cases.

It's worth noting that email confirmation management is really an ongoing process -- emails that were once valid can easily become invalid. This is where the automated bounce processor systems come in (or manually reviewing bounce messages). So while not 100% perfect, this situation is not necessarily different from an email being confirmed and then later becoming invalid.