XF 1.3 User with "Awaiting Approval" state can post

[efendi]

hello,

in my settings "Enable Manual Approval" is checked, so every user must be manually approved, that's okay and works fine for me. today an user writes a post and he is state is "valid" but i never approved this account (and no one else, i'm the only admin on this board and the mods don't have an access to the ACP).
how can that be? i'm confused.

thank you

 

[Paul B]

If you have manual approval configured then someone or something (an add-on) must have changed the state.

Check the Admin Log.

Did the user register before you applied the manual approval?

 

[efendi]

If you have manual approval configured then someone or something (an add-on) must have changed the state.

as i said, i'm the only one with access to the ACP. which add-on can change the state?

Check the Admin Log

there are only logs with my ip.

Did the user register before you applied the manual approval?

the setting has always on "manual approval"

strange to:
the registration was 14:48 pm
the post 13:56 pm

 

[Mike]

Any add-on can technically do anything in the DB. Do check the user change log to see if there's any change logged for this user.

Also, based on what you said there, the post was before they registered? That's not possible by default and would certainly imply an add-on is involved.

 

[efendi]

sorry, my english is very bad, but i try it.

Any add-on can technically do anything in the DB. Do check the user change log to see if there's any change logged for this user.

do you mean this:


"gültig" means "valid"

Also, based on what you said there, the post was before they registered? That's not possible by default and would certainly imply an add-on is involved.

i think this is my fault, maybe it's depends on time zone setting. i don't now clearly.

better:
the registration was 13:48 pm
the post 13:56 pm

no one has in this time set the state to valid.

 

[Mike]

I assume the old value is "awaiting approval".

Something cause it to move to that state, but there isn't anything in the default system that would set a user's from there to valid. As there isn't a different user attached to the change, that would likely mean that it changed on a page that was triggered by the user himself. That would fit with there potentially being an add-on involved; this isn't something we've had reported before.