Sorry meant to post in “How to & troubleshooting” either way, Can anyone confirm this issue as a bug and if there may be a ticket for it in trac? Thanks!
@bphelp I haven’t been able to test this for you yet but I did notice yesterday that non-activated users get given a URL which is visible to anyone. For example, if you completed the registration form on my site and chose username ‘bphelp’ – even before you click on the link in the activation email you will be able to go to
mysite.com/members/bphelp
Here you’d see: Your name, the mystery man avatar etc.
Imagine a site that has lots of spam signups. They’d have hundreds if not thousands on unused URLs.
How is this currently handled by BP?
@henrywright-1
I would suppose it is handled by the registration since a non-activated user is issued a URL. To me this seems like a security issue but I would like to get more feedback on this. Thanks!
@bphelp I’ve seen websites that grant login access even before the account has been activated. Twitter is an example.
Thinking about the profile URL being created – Although BP doesn’t give login access, the fact that a profile URL is created opens up opportunities. For example, on registration submit you could add an action that redirects the user to their profile URL. They’ll be logged out of course, but nothing to stop you displaying a template notice like “Your page awaits you. Just activate you account then you can log in”
Still waiting for confirmation if this is a known bug? I really don’t think users that have not activated their account with the activation email should be showing up in the members directory when sorting the members alphabetically because logically they should not be considered members until they have completed the registration and activation process. Any thoughts?