Posted by manoloka on April 19, 2009 at 11:21am
Jump to:
| Project: | Auto Assign Role |
| Version: | 6.x-1.x-dev |
| Component: | Miscellaneous |
| Category: | feature request |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | closed (won't fix) |
Issue Summary
Great module :-)
Isn't it a security risk to assign the role before email verification has been passed?
This way I may be allowing not verified users to do things I only want verified users to be able to do (i.e create specific content)
Maybe it woulb be a good idea to assign a sort of pre-validated role while waiting between the registration form to the email verification. Similar to what Login Toboggan does http://drupal.org/project/logintoboggan.
Comments
#1
Is there any chance of adding an option like this?
#2
I don't consider it to be a security issue because if the site administrator configures the site to require email verification it would not be possible for the new user to log in without passing that step. I don't see a need to add an additional staging step into the process.