How is it that anyone who signs up can post regardless of whether they have confirmed their email?

michaelemerson

I installed a Vanilla forum on a client's website and in the space of a few months has managed to gain over 6,000 spam discussions due to the fact it seems that email addresses do not need to be confirmed or members need to be approved by admin to post. How do I make it so that people who sign up will need to be authorised by an admin before they can even post a discussion or comment?

x00

Go to dashboard/role edit one after another Applicant and Confirm Email

Make sure that neither of these have permission to add comment or discussions, double check an save. Double check that guest can post by logging out an trying.

in dashboard/settings/registration you can either use basic resignation or approval.

If you want email confirm you can set to either Applicant or Confirm Email roles.

michaelemerson

Applicant and Confirm Email roles are both not allowed to post, but the only options for registration roles is either Member or Administrator. I cannot choose Applicant or Confirm Email as a registration option. Is there something I'm missing? Thanks

hgtonight

Welcome to the community!

What version of Vanilla are you running?

michaelemerson

Thank you

It's version 2.0.18.4. But I think I may have cracked it actually - I needed to select SignIn as an option on the role in order to make it available as a registrant role. The only problem I've got now is that since I deleted all the spam discussions, it still includes them in the count in the menu which means there's 3 blank pages in the pagination...

hgtonight

You might be interested in this discussion: http://vanillaforums.org/discussion/18176/refresh-most-recent-by-caches

x00

you need to upgrade to 2.0.18.8 for security fixes.

It is otherwise identical. Don't forget to backup.