I think this is a feature of the mod, but I would like to make it so that even when people are invited they still have to be approved before accessing the website.

Comments

AjK’s picture

AjK commented
Status: Active » Fixed

This is a feature of Drupal itself. Please read the docs regarding user registration.

triangleman85’s picture

triangleman85 commented
Status: Fixed » Postponed (maintainer needs more info)

Actually, the way I have it set up is so that when users register they have to be approved by an administrator. However, after I installed the invite module, users who are invited don't have to be approved at all. They can simply log into the website by following the link in the invite email and start accessing content. I don't even get an email saying that they have registered. I double checked my user settings and it says "Visitors can create accounts but administrator approval is required." Also, "Require e-mail verification when a visitor creates an account" is checked.

ulf1’s picture

ulf1 commented

I can confirm triangleman85 findings, and it is in fact a big security risk and would be great if it could be fixed soon.

I also have set the registration option to: "Require e-mail verification when a visitor creates an account"

If a user send an invitation, the invited individual gets his invitation email, clicks on the link in the email and is being redirected to the user registration form. But after submitting his data, the new user is immediately in the "active" state, contrary to when the regular registration process is used, where the new user is correctly being placed into a "blocked" state until the approval of the administrator.

Thanks,
Ulf

ulf1’s picture

ulf1 commented

I found the problem in the code.

As a workaround out comment the line _invite_unblock($user->uid); in file invite.module in function invite_user().

// _invite_unblock($user->uid);

This workaround of course fixes the problem only if you run with the setting "Visitors can create accounts but administrator approval is required.".
Ideally the unblocking of the user needs to be done depending on the setting.

Cheers,
Ulf

smk-ka’s picture

smk-ka commented
Version: 5.x-1.0 » 5.x-1.6
Status: Postponed (maintainer needs more info) » Fixed

This has been fixed in 1.6. However, there is no support for user approval when in "invite only" mode. That is, in invite only mode users are always approved. If you need this changed feel free to queue a new issue.
--
Stefan Kudwien
www.unleashedmind.com

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)