Details
-
Type:
Improvement
-
Status:
Closed
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: 1.9
-
Fix Version/s: 1.9.2
-
Component/s: Administration
-
Labels:None
-
Affected Branches:MOODLE_19_STABLE
-
Fixed Branches:MOODLE_19_STABLE
Description
Some people I do not want to name complain loudly about spamming on moodle sites which is caused by various configuration issues:
1/ lang/en_utf8/admin.php
$string['configforceloginforprofiles'] = 'Enable this setting to force people to login as a real (non-guest) account before being allowed to see the user profile pages. By default this is enabled (\"true\")';
this should explain the dangers of user profile spam
2/ $string['selfregistration_help'] = 'Choose which auth plugin will handle user self-registration.';
this should explain possibility that spammers might create accounts and spam in forums/blogs, etc.
Issue Links
Activity
- All
- Comments
- History
- Activity
- Source
- Test Sessions
Thanks for everyone's suggestions 
Here are mine:
configforceloginforprofiles:
This setting forces users to login using their account in order to be able to view the personal profiles of other users. If this setting is disabled, it results in the possibility of spammers using personal profiles for posting spam, since they are visible to the whole world.
selfregistration_help:
If an authentication plugin, such as email-based self-registration, is selected, then it enables potential users to register themselves and create accounts. This results in the possibility of spammers creating accounts in order to use forum posts, blog entries etc. for spam. To avoid this risk, self-registration should be disabled.
Here are mine:
configforceloginforprofiles:
This setting forces users to login using their account in order to be able to view the personal profiles of other users. If this setting is disabled, it results in the possibility of spammers using personal profiles for posting spam, since they are visible to the whole world.
selfregistration_help:
If an authentication plugin, such as email-based self-registration, is selected, then it enables potential users to register themselves and create accounts. This results in the possibility of spammers creating accounts in order to use forum posts, blog entries etc. for spam. To avoid this risk, self-registration should be disabled. 
proposals from Nicolas and me:
1/ Enable this setting to force people to login as a real (non-guest) account before being allowed to see the user profile pages. If this setting is disabled, profiles do not require login and anybody may read them, which may encourage users to use their profile for spamming (that's bad).
(If you do not understand, then just keep this enabled :-P)