The forum of the forums
Welcome to the Official Support Forum of Forumotion!

To take full advantage of everything offered by our forum, please log in if you are already a member, or join our community if you've not yet.



Create a free forum like this one.

User account activiation

View previous topic View next topic Go down

In progress User account activiation

Post by ghost_2005 on May 7th 2014, 9:40 pm

Hi

I am administrator on a forum where I have set preferences so that any new user accounts need to be validated by an administrator before they can be activated.

Today I have had 2 people register accounts, I have received notifications to my personal email account informing these accounts have been registered and are awaiting activation. I did not in either case click the link in the email to activate these accounts and yet both accounts have been activated.

I created a dummy account for myself to try and test what is going on, but was unable to log in with this account until I had activated it.

Is there anyway people would be able to bypass the account activation process?

ghost_2005
New Member

Posts : 10
Reputation : 1
Language : English

http://bookies.forumotion.co.uk/

Back to top Go down

In progress Re: User account activiation

Post by Illest on May 7th 2014, 10:00 pm

No, there's no way to bypass it. Are you sure it's on 'Admin' and not 'User'?

Illest
Forumember

Male Posts : 135
Reputation : 9
Language : English
Location : USA

http://mixedmedia.userboard.net

Back to top Go down

In progress Re: User account activiation

Post by ghost_2005 on May 7th 2014, 10:38 pm

@Illest wrote:No, there's no way to bypass it. Are you sure it's on 'Admin' and not 'User'?
Definitely set to 'Admin'. I registered a dummy account myself as a test and was unable to access without doing the validation. This was after I had had one 'unauthorised' registration. A few minutes later I noticed another person had managed to register an account and it had also been activated.

The first person who registered was a user whose account I had deleted a couple of days ago, so I wondered if by re-registering under the same username they could have bypassed authorisation. But the second person to register had not had an account before and were using a completely new username.

ghost_2005
New Member

Posts : 10
Reputation : 1
Language : English

http://bookies.forumotion.co.uk/

Back to top Go down

In progress Re: User account activiation

Post by Illest on May 7th 2014, 10:47 pm

Please provide your forum link so I can test it out myself.

Thanks in advance.

Illest
Forumember

Male Posts : 135
Reputation : 9
Language : English
Location : USA

http://mixedmedia.userboard.net

Back to top Go down

In progress Re: User account activiation

Post by ghost_2005 on May 7th 2014, 10:52 pm


ghost_2005
New Member

Posts : 10
Reputation : 1
Language : English

http://bookies.forumotion.co.uk/

Back to top Go down

In progress Re: User account activiation

Post by Illest on May 7th 2014, 10:55 pm

That's strange because it requires you to activate my account before I can login, which is what you want but you said it's not doing it for other members?

Illest
Forumember

Male Posts : 135
Reputation : 9
Language : English
Location : USA

http://mixedmedia.userboard.net

Back to top Go down

In progress Re: User account activiation

Post by ghost_2005 on May 7th 2014, 11:11 pm

Two people definitely managed to register without my having activated them. The other thing I noticed when I first went to the administration panel to check my settings was that it was set to 'simple' rather than 'advanced' (I always have it set to 'advanced').

Could someone have hacked my account? Even if they had (unlikely), the permissions for new users were still set to only allow 'admin' activation.

I am going to change setting to 'allow new members' - no, as an extra measure for the moment and monitor what happens.

ghost_2005
New Member

Posts : 10
Reputation : 1
Language : English

http://bookies.forumotion.co.uk/

Back to top Go down

In progress Re: User account activiation

Post by Illest on May 8th 2014, 12:25 am

That's odd too because your preferences aren't supposed to change.
And that's a good idea. But I would enable re-authentication into the ACP just for more security.
You can do this by going to ACP => General => Forum => Security => Confirm password to administration access : Yes

Illest
Forumember

Male Posts : 135
Reputation : 9
Language : English
Location : USA

http://mixedmedia.userboard.net

Back to top Go down

In progress Re: User account activiation

Post by ghost_2005 on May 8th 2014, 1:24 am

Thank you. I have done that.

I will monitor the situation. Hopefully there will be no further irregular activities.

ghost_2005
New Member

Posts : 10
Reputation : 1
Language : English

http://bookies.forumotion.co.uk/

Back to top Go down

In progress Re: User account activiation

Post by Illest on May 8th 2014, 1:25 am

You're welcome. Keep me updated. Smile

Illest
Forumember

Male Posts : 135
Reputation : 9
Language : English
Location : USA

http://mixedmedia.userboard.net

Back to top Go down

In progress Re: User account activiation

Post by SLGray on May 8th 2014, 3:48 am

Are you the founder of the forum? Also are there other administrators?


When your topic has been solved, ensure you mark the topic solved.
Never post your email in public.


SLGray
Administrator
Administrator

Male Posts : 35667
Reputation : 2375
Language : English
Location : United States

http://fmthemes.forumotion.com/

Back to top Go down

In progress Re: User account activiation

Post by ghost_2005 on May 8th 2014, 7:18 am

@SLGray wrote:Are you the founder of the forum? Also are there other administrators?
Hi - yes I am the founder of the forum. I have one other administrator, but he also 100% did not activate these accounts. (He is also tech smart, so he would not have accidentally clicked any activation link by mistake).

For added security we decided to temporarily remove his admin status in case that could be an issue.

ghost_2005
New Member

Posts : 10
Reputation : 1
Language : English

http://bookies.forumotion.co.uk/

Back to top Go down

In progress Re: User account activiation

Post by Jophy on May 8th 2014, 7:25 am

Hello,

There's a feature in the admin panel that tracks all administrators' activities:
AP > General > Security > Administration:
Check if there's an action : "User updated"

Jophy
ForumGuru

Male Posts : 17924
Reputation : 835
Language : English
Location : Somewhere

Back to top Go down

In progress Re: User account activiation

Post by ghost_2005 on May 8th 2014, 7:45 am

Okay, I've looked at the list of Administration actions. I have 'User updated'showing for 6th when I gave admin status. It shows again for last night when I removed that admin status. There are no Administration actions showing that are not under my username. There are no actions listed showing activation of the 2 accounts from last night. Previous members that I did activate, all show up as being activated by me in the list.

ghost_2005
New Member

Posts : 10
Reputation : 1
Language : English

http://bookies.forumotion.co.uk/

Back to top Go down

In progress Re: User account activiation

Post by Jophy on May 8th 2014, 8:15 am

Ok, so the other admin did the activation as being shown in the administration logs?

Jophy
ForumGuru

Male Posts : 17924
Reputation : 835
Language : English
Location : Somewhere

Back to top Go down

In progress Re: User account activiation

Post by ghost_2005 on May 8th 2014, 9:15 am

@Jophy wrote:Ok, so the other admin did the activation as being shown in the administration logs?
No - there is nothing in the logs showing these 2 accounts were activated by anyone. The other admin has done nothing. The only actions that show up under his name are post deletions listed under the moderation tab.

That is the mystery - there is nothing to show the permissions for user account activation were changed by either me or the other admin and nothing to show these accounts were activated by myself or the other admin. And yet both these accounts were active because one of them was able to post several messages on the forum.

ghost_2005
New Member

Posts : 10
Reputation : 1
Language : English

http://bookies.forumotion.co.uk/

Back to top Go down

In progress Re: User account activiation

Post by Leviosa on May 28th 2014, 9:29 am

@ghost_2005 wrote:
@Jophy wrote:Ok, so the other admin did the activation as being shown in the administration logs?
No - there is nothing in the logs showing these 2 accounts were activated by anyone. The other admin has done nothing. The only actions that show up under his name are post deletions listed under the moderation tab.

That is the mystery - there is nothing to show the permissions for user account activation were changed by either me or the other admin and nothing to show these accounts were activated by myself or the other admin. And yet both these accounts were active because one of them was able to post several messages on the forum.
Hello

Could you send me a private message with:

- Your forum
- 2 usernames registred without your validation
- their registration date
- the link of this topic

Many thanks in advance

:rose:


No help without your forum url
No support via private message



Leviosa
Administrator
Administrator

Female Posts : 15386
Reputation : 1563
Language : French, English

http://help.forumotion.com

Back to top Go down

View previous topic View next topic Back to top


 
Permissions in this forum:
You cannot reply to topics in this forum