Totara Learn Open Discussions

The specific implementation includes using vanity URLs that redirect to include data on the tenant and audience for self-registration. On the back end, our Totara partner has it set up to do the automatic approvals when they are in those audiences. It's much less likely that hackers would come up with a URL that includes the ?aud=AUDIDHERE&tenanttheme=themeid at the end. Frankly, if they do, and we see that it's a problem, it will be an issue for our Totara partner to resolve, as this was their solution to the fact that we have users without email addresses. And honestly, if someone registers at the base URL without one of those codes, they won't become part of a tenant and won't have access to any training content. A learner account that gets access to an empty default dashboard can't do much damage. Thanks for the warning though.