Post under moderation has been sent by email

peopleinside

Hi, today I get a new member on my community
0.1.0-beta.16P HP 7.4.19
this member after register to my community posted a message in the topic I started from my admin profile.

This post was queued fr moderation, I'm using also extension First Post Approval

I noticed of this post because I get an email alert.

Why I'm reeving an email alert with the post text if the post has not been approved?
I expect maybe to get an email that alert me a post is awaiting to be moderated and I expect post email are sent just only after the approve action.

Seems spammers can made post that is queue in the moderation but still be delivered by email?

At the end of the notification email that alert me about a new post in a discussion I'm following there is the following sentence: You will no longer receive notifications about this thread until you are updated.

Where I can change this? This email is from the subscription component?

php flarum info

 
Flarum core 0.1.0-beta.16
PHP version: 7.4.19
Loaded extensions: Core, date, libxml, pcre, dom, fileinfo, filter, hash, json, SPL, bz2, posix, Reflection, session, SimpleXML, standard, xml, xmlreader, xmlwriter, bcmath, openssl, calendar, ctype, curl, dba, mbstring, ftp, gd, gettext, gmp, iconv, imap, intl, ldap, mailparse, exif, memcached, zlib, pcntl, PDO, pdo_sqlite, shmop, soap, sockets, sodium, sqlite3, sysvsem, sysvshm, tidy, tokenizer, xmlrpc, xsl, zip, Phar, mysqlnd, mysqli, pdo_mysql, ionCube Loader, Zend OPcache
+-------------------------------------+------------------+--------+
| Flarum Extensions                   |                  |        |
+-------------------------------------+------------------+--------+
| ID                                  | Version          | Commit |
+-------------------------------------+------------------+--------+
| flarum-flags                        | v0.1.0-beta.16   |        |
| flarum-markdown                     | v0.1.0-beta.16.1 |        |
| flarum-approval                     | v0.1.0-beta.16   |        |
| flarum-subscriptions                | v0.1.0-beta.16   |        |
| flarum-tags                         | v0.1.0-beta.16   |        |
| nearata-twofactor                   | v1.0.4           |        |
| askvortsov-rich-text                | v1.1.1           |        |
| fof-linguist                        | 0.6.0            |        |
| fof-terms                           | 0.6.2            |        |
| fof-merge-discussions               | 0.5.1            |        |
| clarkwinkelmann-first-post-approval | 0.1.4            |        |
| fof-follow-tags                     | 0.7.2            |        |
| fof-username-request                | 0.5.0            |        |
| fof-split                           | 0.7.0            |        |
| fof-cookie-consent                  | 0.5.0            |        |
| fof-disposable-emails               | 0.3.0            |        |
| clarkwinkelmann-emojionearea        | 0.3.1            |        |
| fof-nightmode                       | 0.8.0            |        |
| fof-stopforumspam                   | 0.5.0            |        |
| fof-spamblock                       | 0.5.0            |        |
| fof-oauth                           | 0.3.0            |        |
| flarum-emoji                        | v0.1.0-beta.16   |        |
| fof-user-directory                  | 0.6.2            |        |
| flarum-pusher                       | v0.1.0-beta.16   |        |
| flarum-suspend                      | v0.1.0-beta.16   |        |
| fof-user-bio                        | 0.5.0            |        |
| fof-default-user-preferences        | 0.4.0            |        |
| nearata-lang-italian                | v0.1.0-beta.16   |        |
| flarum-akismet                      | v0.1.0-beta.16   |        |
| flarum-statistics                   | v0.1.0-beta.16   |        |
| flarum-lang-english                 | v0.1.0-beta.16   |        |
| flarum-sticky                       | v0.1.0-beta.16   |        |
| flarum-mentions                     | v0.1.0-beta.16   |        |
| flarum-lock                         | v0.1.0-beta.16   |        |
| flarum-likes                        | v0.1.0-beta.16   |        |
| flarum-bbcode                       | v0.1.0-beta.16   |        |
| noriods-auto-more                   | 0.3.1            |        |
| fof-links                           | 0.6.0            |        |
| fof-moderator-notes                 | 0.5.0            |        |
| fof-recaptcha                       | 0.3.2            |        |
| ianm-synopsis                       | 0.2.0            |        |
| justoverclock-welcomebox            | 1.1.6            |        |
+-------------------------------------+------------------+--------+

Thanks for the help.

clarkwinkelmann

peopleinside have you tried with just the Approval extension and not "First Post Approval"? Maybe there's a bug in just my extension? However if it happens with both then the problematic code is likely in the Subscriptions extension that adds that notification.

peopleinside

Hi clarkwinkelmann thanks for your reply.
I never tried and today i got my first member, the second to be honest but this was the first user post.

If is not your extension issue maybe this can be a useful issue to report on Flarum as spammers can be able to send emails to members using this.

I still have the issue in Flarum to be not alerted when a post in in the queue for moderation... this time this bug somewhere helped me to approve more quickly the post.

The email seems is sent from subscription so maybe is this the cause of the email notification also if the post is in the moderation queue.

peopleinside

Hi, today I discovered first post approval moderate also Byobu private message; this is not bad but the issue is:

If a new member that is a spammer send a private message to another member:

an email alert about the private message also if the message is in the moderation queue
member will receive the email but will be not be able to see the private message because need to be approved first
when the private message will e approved, no more email notification are sent to the member to telling to check private message

You asked to check if the fact email are sent for queue moderated post is caused by fist post approval or not.
I don't know what workflow do for check that.. Checking that I think to found a new Flarum bug... that I need report.

The workflow for test this issue for me is set a tag where all post should be first approved and disable first post approval.
I given permission to only admin to post without approval at the tag Altro on my community than I post a new post from a member profile.

The message is posted and is showed as need approvation but also guest can see this message.

Wow now I'm unable to replicate. I'm loosing in those test 😃 unable to replicate a queue in moderation post is visible to guest.

Message in the moderation queue seems is notified by email also if your extension "first post approval" is disabled... so basically extensions like Follow tags should not send email if the post is not approved.

I don't know if the issue is present also wen mention, post reply etc. Is other test that need to do but today I made some confusion with many tab opened and admin, member, etc. Things to test are a lot.

Confirmed the issue private message in put in the moderation queue and Byobu notification the private message by email but the message cannot be read until is not approved and when is do, no notification email are sent to notify the user.

The private message or post message email should be sent only after approved.

Seems approval allow to send email to post that are not yet approved.
If all post under a specific tag need to be approved before be visible and some member follow this tag with the Follow Tag extension than a spammer create a post that is put in the moderation queue, users will get the notification email also if the post has not been approved.

The same issue happen with Byobu private message: I Use first post approval extension, if a new user send a private message this is put on queue moderation and is notified by email. This cause the issue that member that are not an admin will be unable to see the private message that has been notified by email.

When the private message will be get approved, no email notification will be sent.

What I expect is that messages are notified by email only after they has been approved.

flarum/core2913