[RFC] Usability: Login on registration

[igorw]

We can improve the usability of the registration process a lot by automatically logging the user in.

Why is this not done yet?

A user cannot login until he is activated. This is done to prevent spam as well as prove the authenticity of the users' email address.

How to address those issues

The idea is to automatically log the user in after registration, and also allow him to login without activation. However, until he activates his account he will not be able to perform any actions that a) result in public content b) involve his e-mail address.

He will not be able to:

• Create topics, posts, PMs
• Send emails through the board
• <please suggest more>

In order to do this we need to add checks to those relevant parts of code, to make sure the user is activated.

Further implications

Unactivated users are now registered users. They can view anything a registered user can before activating. I do not see any issues with this.



Did I miss any things that must be denied? Are there any issues I did not address?

[Arty]

He will not be able to:

• Alter any parts of profile

Otherwise birthday lists would be full of inactive users and their profiles would be full of spam links, hoping that some users checks their profile.

[DavidIQ]

• Send emails through the board

Might be obvious but I think they should not be able to see any of the communication links at all or make them unusable icons which would include IM links as well as the email link which could also reveal the user's email depending on board configuration.

Reply button(s) should be displayed but if they try to use them show a fail message.

[A_Jelly_Doughnut]

Can the things listed be handled with permissions? That's the easiest implementation...

Inactive users group can:
Post via the moderator queue.
Not send email
Not send PMs
Not receive PMs

[nickvergessen]

WHen we implement this with a group, we should also implement a auto-group system (user groups depending on post-count)

[A_Jelly_Doughnut]

He will not be able to:

• Alter any parts of profile

Otherwise birthday lists would be full of inactive users and their profiles would be full of spam links, hoping that some users checks their profile.

Inactive users are already hidden from the Birthday list. But implementing a permission "can alter profile" would be one way to make phpBB users who link their users information from another source happy.

[DarkBeing]

............

Further implications

Unactivated users are now registered users. They can view anything a registered user can before activating. I do not see any issues with this.

......

In general a nice idea. The only issue I see so far is, that on some boards I have come across, you are required to register and activate your account before you can see anything to prevent content leakage (I guess). If you register and can see everything, why bother to activate your account?
Thinking about it, why not skip the whole user activation in this case in general and simply create a "newbie" group with certain permission. Can do X till created X posts or whatever to become a "normal" member?

Also will this not create issues when you have a 18+ rated board and unactivated "users" can already view everything? I guess can be fixed eventually with permissions. But this brings me back to the question, then why have user activation at all?

[igorw]

DarkBeing, if we go with the "inactive users group" (an idea I really like so far) then the "seeing things you shouldn't" problem is non existent, given the change is sufficiently documented.

As to why we have user activation, the first post already gives a vague explanation: "This is done to prevent spam as well as prove the authenticity of the users' email address." While I don't know how relevant the spam argument is anymore (that's what CAPTCHAs are supposed to be for), the identity thing is still important. It comes down to this: we do not want users signing up with other people's e-mail address and those other people getting emails from the board as a consequence.

[naderman]

Also will this not create issues when you have a 18+ rated board and unactivated "users" can already view everything? I guess can be fixed eventually with permissions. But this brings me back to the question, then why have user activation at all?

I think you misunderstood, this is about email activation, where users activate themselves. I think in the case of admin activation we should not allow people to login at all until they are activated.

[A_Jelly_Doughnut]

I think you misunderstood, this is about email activation, where users activate themselves. I think in the case of admin activation we should not allow people to login at all until they are activated.

I'm not sure why they two modes should be different, especially if there are appropriate permissions to disallow the inactive users from really doing anything?