XF 2.2 Approval queue

[Hareon]

I have a small question about the approval queue.

When I receive a profile to approve, has his email already been confirmed? I ask this because when I Approve, the profile automatically becomes Valid.

I've already received some profiles for validation and I'm not sure what the term "username X" means. Is it some spammer registration? Is the email from a spammer? Is the IP from a spammer?

 

[Mr Lucky]

In the above example it means there have been 24 reports of spam for that username. For such a common name I would not assume it is the same user/s as got all those reports. The email would have been checked against the database, if that had SFS flags it would be a lot more meaningful.

 

[Hareon]

In the above example it means there have been 24 reports of spam for that username. For such a common name I would not assume it is the same user/s as got all those reports. The email would have been checked against the database, if that had SFS flags it would be a lot more meaningful.

Ah, so that's what the number with "username" meant? Interesting. I never imagined it would be this. So when I see more approval queues like this I will ignore and approve.

What about email? Is it already confirmed before entering the approval queue?

 

[Mr Lucky]

What about email? Is it already confirmed

I believe so if your registration requires email confirmation. EDIT: this is wrong.

 

[Hareon]

I believe so if your registration requires email confirmation.

Yes. All registrations require email confirmation. I was having doubts as to whether someone who is flagged as a spammer goes straight to approval or even confirms the email before that. If it goes straight to approval, it would be dangerous to approve a registration without a confirmed email, as approval would "skip" the step of confirming an email.

The question was knowing how it works in Xenforo and whether the confirmation step is not skipped.

 

[Mr Lucky]

I was having doubts as to whether someone who is flagged as a spammer goes straight to approval or even confirms the email before that.

Just checked and it is not as expected.

User (before email approval) goes to approval queue. Approving the user at that point changes their status to valid.

Not a a great system IMO

 

[Mr Lucky]

Just checked and not as expected.

I should have known because I mentioned this years ago and this was the response:

I suppose there's a possibility of a change here, but I think it's somewhat unlikely. This approach was taken for technical reasons. Specifically, it was to ensure that when we check a registration against various spam databases, we're using the actual heuristics from registration. If we delayed that until confirmation, we wouldn't have all the information. Saying that, there would be ways around it, but it's a much more extensive change.

That said, I can't say that I've found this problem to be an issue in practice. Emails can become invalid at any time, so it's something that you need to deal with after registrations as well (such as with the email bounce handlers). If the email is invalid, then it's quite likely to be discovered quickly. (Not to say it's perfect, but it's a balance of trade offs.)

 

[Hareon]

Sad. So I dont know if this is a fake email. Need to take more step putting the acount to send confirmation. This should be automatic.

 

[Mr Lucky]

So I dont know if this is a fake email.

If it's a spammer, it's unlikely to be fake because they'd never get to achieve their goal of posting spam.

 

[Neilski]

Is the IP from a spammer?

I doubt it, having just looked it up. But personally I would not recommend sharing IP addresses in public like this, since I believe they are usually considered to be PII. Combined with a username, even more so.

 

[Hareon]

I doubt it, having just looked it up. But personally I would not recommend sharing IP addresses in public like this, since I believe they are usually considered to be PII. Combined with a username, even more so.

Yeah, but I cant edit anymore.

 

[Reflect]

I believe you are having the same problem I encountered. It is a known issue:

For more details please see: https://xenforo.com/community/threads/manual-approval-queue-bypass.200485/#post-1548843

The solution I found was to disable the option "Manually approve registration if user shares IP used by a banned or rejected user in last:" in the user registration options, and manually approve all new registrations. When a user first registers they confirm their email, and after that they are passed into the manual approval queue. That way they can't bypass the email confirmation.

 

[Hareon]

I believe you are having the same problem I encountered. It is a known issue:

For more details please see: https://xenforo.com/community/threads/manual-approval-queue-bypass.200485/#post-1548843

The solution I found was to disable the option "Manually approve registration if user shares IP used by a banned or rejected user in last:" in the user registration options, and manually approve all new registrations. When a user first registers they confirm their email, and after that they are passed into the manual approval queue. That way they can't bypass the email confirmation.

OK I disabled the option "Manually approve registration if user shares IP used by a banned or rejected user in last:". This was activated. Lets see if this solve the problem.

Maybe Xenforo need to too a little look in these options for bypasses.

 

[Neilski]

disabled the option "Manually approve registration if user shares IP used by a banned or rejected user in last:"

I hope you also set it to manually approve all registrations then?

 

[Hareon]

No. I really took it all off. At least for now everything is working (until I find out something goes wrong)

 

[Neilski]

No. I really took it all off. At least for now everything is working (until I find out something goes wrong)

Ah OK. For me, detecting fresh sign-ups by banned users is better than maintaining email confirmations. It's a shame we can't have both of course.