Require email verification before creating a new user

I did change our site to use this feature. Only thing I don’t like is that when they click the activation link on their email they are automatically approved. Would prefer that the Admin still had to approve them. To get around that I have them get assigned to a role that has no access rights so they only see what the non-logged in user sees. The Admin now has to move them to the role that does get access rights. Not ideal and the Admin cannot use the generated email to know to approve them. But they will just leave that as an unread email until the person activates their account. Then they will change their role and delete the email they get. Could be many days before the person requesting access actually clicks on the activation link so the Admin has to keep going back in to see if they activated their account. Instead of approving them they now have to change their role. We’ll give it a go. Only been one person who has been really abusing the access request 10-20 times every day. Being an approved user does not really gain them all that much other than access to some preschool calendars and a few other pages of content for parents. But “James Smith” who has hundred of emails address just keeps on trying…

That gets us back to where we started. Require email activation almost works. But when they validate they go right to approved. We change the default role to a role that provides no additional access. Once they validate using the generated email they are approved but the admin then has to change their role. No problem doing that but they need to keep checking to see if they have validated as they do not get notified when they do. Once they see they have in order to get the plug in to generate the Account Approved email they have to first change the status to “Put As Pending Review” (have turned off the email generated by plug-in for this stage), change the role to the one that gets access, and then change the status back to “Approve Membership”. That last change generates the email letting the requestor know they now have access.

There is no way to go from “Awaiting E-mail Confirmation” to “Pending Review” or the Admin to be notified once the requestor validates their email. But our process will work it just requires the admin to keep checking to see if the new requestor has validated yet.

My issue is that you pick one or the other. What I would like would be to set it to “Require Email Activation” and after the Requestor does that, it changes to “Require Admin Approval”, That would make sure they provided a valid email address and once validated, the Admin reviews and approves. All the UM generated emails would then work as well.

I did change to use “Require Email Activation” and use a default Role that has no rights. I say that almost works since if someone authenticates their email they automatically get approved with no Admin update required. In our Use Case, the Admin really has to go in and review their request and if valid, change their role. Only at that point are they approved. The Admins are not doing that until the person authenticates their email. I think I will recommend that they review the request even before the person validates their email address and if valid, change their role. That way they do not have to continuously go back and look to see if they validated the email. Our issue is that the automatic emails are not matching up with the process.

If we change back to “Require Admin Approval” someone like this pest who keeps trying to sign on using a long list of email addresses does not have to validate they have a valid email address. Not once with 100s of attempts did they validate one of the email addresses used. They obviously have a list of “hacked” email addresses. Surprised no one has replied asking why they got one of the activation emails.

What would be nice is if we could use “Require Email Activation” and then once they validate the email address the system would then change status to “Require Admin Approval”. That would generate the automatic UM mails about Pending Review, Approved or Rejected. The way it is now is you have to pick one or the other.

Or, maybe add reCaptcha to help fend of people like this. I do believe in this case it is a bot submitting these as I took away the Register link and they still were going direct to that page. I had to remove it altogether for now to stop them. No idea why they are so persistent. Nothing that interesting for them to get access to…