Why are users allowed to post before their registration has been verified?

finid

I was surprised to learn that registered users are allowed to post before they have verified or confirmed their email. To cut down on spurious postings, I think it'd be better to give site admin the option to allow/disallow posting before an email has been verified.

The only feature close to that in the ACP is on the Post tab of the General Settings page which ways that Allow guests to post without logging in. I think there should be one that says something like Allow registered users to post without confirming email

a_5mith

I'd guess it was some sort of bug, along with deleting an account of someone who is online which means they can carry on posting as a user with no username etc.

finid

@a_5mith

Is it a bug or is that the way NodeBB was coded to work?

a_5mith

@planner Definitely a bug.

The only difference between the two images is that I went into the ACP in another browser, deleted the Test.ing account, then refreshed the Test.ing browser. Even with allow guest posting turned off, I'm able to make new threads, reply to topics as if I were an actual member. Clicking Profile on the deleted account just refreshes whichever page you're currently on.

I seem to recall when we had the spam issues here that someone else noted similar behaviour.

finid

@a_5mith

Yep, I noticed that too after I deleted an accounted I created. User and access management sure need some more loving attention.