[allura:tickets] Ticket 7704 discussion

[Alexander Luberg <al...@slashdotmedia.com>]

- **status**: review --> in-progress
- **Reviewer**: Alexander Luberg
- **Comment**:


1) register user1 with email: abc@domain.net
2) confirm it
3) login - it works correctly
4) logout * register user2 with same email
5) You will get an email that someone tried to register an account with the email - good
5) login as user1 - you will be redirected to /user/pending instead of homepage



---

** [tickets:#7704] Option to require email for user registration**

**Status:** in-progress
**Milestone:** unreleased
**Labels:** sf-4 42cc sf-current 
**Created:** Fri Sep 19, 2014 07:17 PM UTC by Dave Brondsema
**Last Updated:** Thu Oct 30, 2014 04:58 PM UTC
**Owner:** Igor Bondarenko

Allura doesn't currently require an email address for user registration.  There should be an option to require it.  We have an option called `auth.require_email_addr` which is enforced on the /auth/preferences page, so we could use the same setting to control how user registration works.

Users should be in a 'pending' state (new flag) initially, and system should send a password verification email (similar to what we already do on /auth/preferences).  After that email is verified, user is no longer pending.

We will have to update many places in the code to check the new 'pending' state.  Probable best to search everywhere users are searched by 'disabled' or `someuser.disabled` is checked, and determine if the pending flag needs to be checked too.  Since pending users shouldn't be allowed to do anything yet.


---

Sent from forge-allura.apache.org because dev@allura.apache.org is subscribed to https://forge-allura.apache.org/p/allura/tickets/

To unsubscribe from further messages, a project admin can change settings at https://forge-allura.apache.org/p/allura/admin/tickets/options.  Or, if this is a mailing list, you can unsubscribe from the mailing list.