Details
-
Type:
Bug
-
Status:
Open
-
Priority:
Minor
-
Resolution: Unresolved
-
Affects Version/s: 1.8.6, 1.9.2
-
Fix Version/s: STABLE backlog
-
Component/s: Authentication
-
Labels:
-
Affected Branches:MOODLE_18_STABLE, MOODLE_19_STABLE
Description
The No Authentication module requires users to validate email accounts before allowing the users to register for courses.
I realize No Authentication is not to be used for production systems, but it is not working as described:
"Users can sign in and create valid accounts immediately, with no authentication against an external server and no confirmation via email. Be careful using this option - think of the security and administration problems this could cause."
Another user has documented this on the forums:
http://moodle.org/mod/forum/discuss.php?d=107201
Steps to reproduce:
Enable "No Authentication" as the only authentication module
Log out as the Administrator
Try to login with a new username & password
It prompts for First name, last name, email address, description
Click [Update Profile]
Moodle displays a message: "You have requested a change of email address, from to asdf@asdf.com. For security reasons, we are sending you an email message at the new address to confirm that it belongs to you. Your email address will be updated as soon as you open the URL sent to you in that message."
Now if the user tries to enter a course they are returned to the "Edit Profile" screen and not allowed to proceed until the email is confirmed.
In administration menu go to
Security > Site policies> and uncheck Email change confirmation (emailchangeconfirmation)
Save settings
Now registration without email validation is working