Hello,

The referral module assigns userpoints when a new & referred user is inserted into the database (hook_user op='insert'). Email verification of the new user's account is not required. This introduces the risk of gaming/cheating, as it would be simple for someone to write a script that programatically requests the referral url and creates accounts.

Ideally, we could call userpointsapi only after a user has completed the email verification. This is complicated by email verification being optional. Perhaps further complicated by logintoboggan, which can be configured to auto-activate the user, but not escalate the user-role to 'authenticated' until the email verification is complete.

Thoughts?

Comments

pomliane’s picture

pomliane commented
Component: Code » Code: referral
Status: Active » Closed (won't fix)

This version of User Referral is not supported anymore. The issue is closed for this reason.
Please upgrade to a supported version and feel free to reopen the issue on the new version if applicable.

This issue has been automagically closed by a script.