As designed Registration: User can create an account with the same username as a previously deleted user

[Metin Galimidi]

Hello,
I am using Xenforo 1.3 It seems to be possible to create an account with the same username as a previously deleted user. This is especially problematic when the posts of a deleted user are still kept in the system. Could you please let me know if there is a way to resolve this issue?

Steps to reproduce :

1. Go to the site
2. Register a new user
3. Confirm the registration
4. In the admin delete the user (or follow regular delete process)
5. Register another user with the same username as in Step2

Actual result: The new user is registered with the same username as the previous one

Expected Result: User should be presented with an error messaging saying that this username is already in use and shouldn't be allowed to register with that name.


Thanks

 

[Mike]

When you delete the account, it's as if the user never existed. Nothing is associated with the user any longer. Similarly, if you allow guest posts, a user can register a username that was used on a post previously (the old post will not be associated with the user).

If this is a significant issue, you would have to not delete the account.

 

[Metin Galimidi]

Thanks for your comments Mike. I think it is definitely an issue that would have been great to have a way to circumvent. i.e. If there was an option to not allow anyone to re-register with the same name , or at least to make it clear that a post belongs to a user that has been deleted it would have been great.

 

[Jeremy]

It marks any old posts as being made by "Guest".

 

[Metin Galimidi]

Hi Jeremy,
Thanks for your feedback. In our forum a guest like in, Xenforo Community forums, is not allowed to make any postings at all so the terminology used sounds a bit confusing to me. So maybe it is as simple as changing the wording?

 

[Amaury]

Hi Jeremy,
Thanks for your feedback. In our forum a guest like in Xenforo Community forums is not allowed to make any postings at all so the terminology used sounds a bit confusing to me. So maybe it is as simple as changing the wording.

Edit the corresponding user group user titles and phrases if you want to make it less confusing, then.

 

[Metin Galimidi]

Amaury thanks Except a guest and a deleted user doesn't fall under the same roof

 

[Amaury]

Amaury thanks Except a guest and a deleted user doesn't fall under the same roof

Guest users do have a user title; by default it is "Guest."

 

[Metin Galimidi]

@Amuary I understand that but the user that got deleted is not (was not a guest user) when it gets deleted it gets marked as a guest user which is inaccurate.

 

[Jeremy]

By definition, a post that is not associated with a registered user would be a "guest" post.

 

[xIsabel38]

As Mike already stated, when you delete a user all of the corresponding information associated is deleted too so technically someone can register again using the same name or even same email address. I'm not going to tell you how to admin your forum so if you want to still delete accounts but you don't want users to be able to register with those names then the only way I can see you doing this is by adding the name to the disallowed usernames field in your User Registration options.

 

[Harpers Tate]

...or, instead of deleting unwanted accounts, you ban them instead. Doing that preserves the account and name but prevents it from being used.

 

[whynot]

then the only way I can see you doing this is by adding the name to the disallowed usernames field in your User Registration options.

Good idea.

 

[Metin Galimidi]

Thanks all. @Harpers Tate thats a good suggestion thank you.

 

[tyteen4a03]

Thanks all. @Harpers Tate thats a good suggestion thank you.

An addon can also be made to achieve such behaviour - it's pretty easy to do so.

 

[wmtech]

Thanks for your comments Mike. I think it is definitely an issue that would have been great to have a way to circumvent. i.e. If there was an option to not allow anyone to re-register with the same name , or at least to make it clear that a post belongs to a user that has been deleted it would have been great.

There is now an add-on for that:
http://xenforo.com/community/resources/wmtech-deleted-usernames-protector.3066/

 

[Metin Galimidi]

Thanks @wmtech I think that this plugin is a nice addition

 

[rainmotorsports]

...or, instead of deleting unwanted accounts, you ban them instead. Doing that preserves the account and name but prevents it from being used.

Which also bans the email address used. Deleting the accounts allows the user to return with the same email and is pointless if your trying to forcibly remove them. Account deletions aren't for removing trouble makers, just delete their content and ban them if that was the desired effect.

@Metin Galimidi - Not sure what software you came from but this is normal behavior for vB and probably other forum software as well. Nice to see someone made an addon for sites that have special operating requirements though.

 

[Metin Galimidi]

@rainmotorsports I appreciate the comments of everyone! I believe in the value of constructive criticism. If it was not the intended functionality that's fine with me as well. If someone already made a plugin I guess they saw the utility of what I was talking about which is great for the XenForo community . The issue is not about special operating requirements: The question for me was not even about removing trouble makers. It is a deeper subject than that . i.e. if an employee that is working is suddenly no longer working and we would like to remove his account but would like to keep everything they did what do we do ? In Wordpress when you delete a user you are presented the option to assign these contents to another user for example.

 

[rainmotorsports]

@Metin Galimidi The main thing is this was filed as a bug report so for the initial issue the reason the response is "as designed" is because it wasn't a suggestion for a new feature. As far as the feature your describing It wouldn't be a waste of time to do a suggestion. It would basically fall under moderation tools Or only show up when a user is being deleted. The main thing is it would only be used by a small percentage of sites on a routine basis and in general very rarely they might not be interested at this time or it be a low priority.

Many sites and many people here to help will just run an SQL command prior to deleting the user to shift all of the content to the other user. But that doesn't seem appealing to some people with no experience. But even with the feature in hand I think the situation is still complex. Whether or not they left on good terms I would never want to assign replies to some poor sap who might have an attitude casted on their name or have someone else claim they said something they didn't. Depending I would say you might want to transfer any recent, relevant, open threads to the next guy and then not assign any replies to them. If the name shouldnt be attached to the replies then transfer them to an account name "A Former Employee". But every company and situation is different.

When I left the dashhacks network before they were sold I actually transfered any threads that might be update in the future to another contributor and its not straight forward on VB. The trick is to have them post in the thread Then merge their post with the first post assigning them the new post owner. I'd have a plugin made for xF and throw it under the moderator drop down if need be these days. I noticed former vB staff accounts were left in place with their posts and a former title. Some sites might close an original thread and archive it creating a new one but that's not desirable for everyone.

At the end of the day even when every great feature most sites will use exists, you are still going to end up needing a little custom work here and there.