Signups automatically advanced if confirmation e-mail fails

[droddey]

This is on the latest version, just installed it last week. I've been testing a new MyBB setup on a new server. Turns out that my ISP on this new system has port 25 blocked. I noticed that any new test signups (despite having selected the email and admin confirmation option) immediately went to 'ready to confirm' state, despite the fact that no e-mail was delivered. So, apparently, if the send of the confirmation e-mail fails outright, as in can't be sent, there is no warning. The account just becomes ready to confirm. It would probably be better to issue an error and leave it in 'waiting for e-mail validation' type state. Otherwise, it would leave a hole for invalid signups to be approved if something went wrong with outgoing e-mail and the admin didn't realize it.

I definitely hope that, if the validation email just can't be delivered or something that the above doesn't happen, and it's only because of some really fundamental (and fairly pathological but still possible) issue with outgoing e-mail delivery. Otherwise, anyone could get a bogus account by just providing an invalid return e-mail. The admin wouldn't know any better and just confirm the signup.

[Matt]

Looking at the code, it's not so much that it allows it to go through even if the email hasn't been sent (as even if it left the server, we'd have no way of knowing if it was actually received), but more that the admin activation code doesn't actually check if the method is set to "both" and check if the user has done their bit, it just goes ahead and activates them. It's less both email and admin activation, more either email or admin activation. Seems strange. I can only imagine this is unintentional but I find it surprising this wouldn't have been picked up before if so.

[Matt]

Ah, seems this has already been fixed for 1.8.9 - https://github.com/mybb/mybb/issues/1569

[droddey]

OK, that makes sense. I've not done any upgrading yet, so I'm not familiar with the process, How long does it typically take for these to roll out to the official release?

---

Any way in the meantime to tell if they have responded to the e-mail?

[droddey]

Any ETA on this one? We had to go live as is, and we'll have to just upgrade later. In the meantime, any means of knowing if they have responded?

[Matt]

In the awaitingactivation table, validated would be 1 if they have responded to the email - I think this is what the ACP will use in 1.8.9 to see which ones the admin should activate.