Great module :-)

Isn't it a security risk to assign the role before email verification has been passed?

This way I may be allowing not verified users to do things I only want verified users to be able to do (i.e create specific content)

Maybe it woulb be a good idea to assign a sort of pre-validated role while waiting between the registration form to the email verification. Similar to what Login Toboggan does http://drupal.org/project/logintoboggan.

Comments

manoloka’s picture

manoloka commented

Is there any chance of adding an option like this?

cyberswat’s picture

cyberswat commented
Status: Active » Closed (won't fix)

I don't consider it to be a security issue because if the site administrator configures the site to require email verification it would not be possible for the new user to log in without passing that step. I don't see a need to add an additional staging step into the process.