As a result, I got such a script, maybe it will be useful to someone.
const Theme = {} const user = require.main.require('./src/user') const privileges = require.main.require('./src/privileges') Theme.getUsersByCategory = async function(data) { const { templateData: { cid } } = data const allUserIds = await user.getUidsFromSet('users:joindate', 0, -1) const asyncFilter = async (arr, predicate) => { const results = await Promise.all(arr.map(predicate)) return arr.filter((element, index) => results[index]) } const availableUserIds = await asyncFilter(allUserIds, async (id) => { return await privileges.categories.can('read', cid, id) }) data.templateData.availableUsers = await user.getUsersData(availableUserIds) return data } module.exports = ThemeWhy are users allowed to post before their registration has been verified?
-
I was surprised to learn that registered users are allowed to post before they have verified or confirmed their email. To cut down on spurious postings, I think it'd be better to give site admin the option to allow/disallow posting before an email has been verified.
The only feature close to that in the ACP is on the Post tab of the General Settings page which ways that Allow guests to post without logging in. I think there should be one that says something like Allow registered users to post without confirming email
-
@planner Definitely a bug.
The only difference between the two images is that I went into the ACP in another browser, deleted the Test.ing account, then refreshed the Test.ing browser. Even with allow guest posting turned off, I'm able to make new threads, reply to topics as if I were an actual member. Clicking Profile on the deleted account just refreshes whichever page you're currently on.
I seem to recall when we had the spam issues here that someone else noted similar behaviour.
