Account Reminder Auto Activating Users That Are Not Validated

What pages are you looking at that show you that the users are active users? Or are you viewing the users table directly and if so which field are you looking at?

Did you by chance run cron manually as the admin user or a user with administer users permission?

I ask because the core User module will write the current time to the access column of the {users} table when user_save() is run if the user_access('administer users') is TRUE when user_save() is called. If you let Account Reminder do its thing via cron then you should not have this problem with the access field getting written to.

For reference look in user_save() around line 215 or so:

    // Consider users edited by an administrator as logged in, if they haven't
    // already, so anonymous users can view the profile (if allowed).
    if (empty($array['access']) && empty($account->access) && user_access('administer users')) {
      $array['access'] = time();
    }

Mmm.. Correct me if I'm asking a stupid question, but why should users be modified on a cron run?

subscribing

This is driving me nuts.

I had hundreds of users who signed up but never activated their accounts, so I wanted a way to remind them via email and then delete them if after a few days they didnt signup still.

But after running cron a few times (for another reason) all of these users were marked as active and given 'last active' times even though they NEVER verified their accounts. So now I cant tell which 300+ users I need to delete.

Seems like a bug if this module doesnt work properly if cron is run as admin - cron is run as admin quite often on lots of my websites.

subscribe

again, the problem is with Drupal core user_save(). It's there that the decision to update the users last access time is made not in account_reminder module. I agree that it's of dubious value. That being said, core is core and you deal with it warts and all.

What I can try to do is to work around this but no promises that it will solve all of your problems. Patches always welcome as well.

Rather than using user_save() would using an update query as in this patch or perhaps drupal_write_record() do the trick?

Also attaching 1.2 patch, previous was for 6.x-1.x-dev

subscribe