Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't bypass registration queue #26

Open
oplik0 opened this issue Jul 18, 2020 · 0 comments
Open

Don't bypass registration queue #26

oplik0 opened this issue Jul 18, 2020 · 0 comments

Comments

@oplik0
Copy link

oplik0 commented Jul 18, 2020

Because this plugin - and everything based on it - is just using User.create, they're bypassing registration queue completely. This means that unless all SSO plugins are disabled, registration queue is almost useless (experienced this myself with a wave of spam accounts using google and discord sso to bypass the queue set in place specifically because these accounts started appearing).

Unfortunately, due to the way registration queue is implemented in NodeBB, there isn't really a good way to "just add the queue" without modifying how it works. Some ideas:

  1. Disable registration completely when queue is enabled (probably the simplest "solution", however it's pretty obvious that it's far from perfect)
  2. If queue is enabled and user is queued, save their username/email somewhere alongside oAuth data and create a function using hook action:user.create that will check if any new user matches the saved data and if there is a match - get the uid and process the user like with normal oAuth registration
  3. If User.shouldQueueUser is true, show the user an error stating that registrations when queue is enabled are not supported or something (and obviously abort the registration attempt)
  4. Actually change the way registration queue works in NodeBB - perhaps it could always assign uids that will be used after acceptation or discarded on rejection of the user? Then this SSO plugins could just use User.addToApprovalQueue instead of User.create if User.shouldQueueUser is true and the problem would be solved.

Btw. I haven't tested it yet, but it seems like there also isn't anything stopping people from registering when invitation-only mode is enabled. The buttons on login page can also register a new user, so even a lack of /register route doesn't help.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant