Totara Learn Open Discussions

Why is the admin getting an email for every new account?

这个讨论区有规定周期内发帖数的限制，它被设置为 1天内最多发 3 个帖子。

We recently finally got email notifications sending correctly from our Totara site, but now the admin is getting a copy of the new account notification email every time someone registers. I've searched through the settings, and I don't see a way to turn off those notifications. I'm sure I'm missing something though.

Where do we turn that off?

永久链接 | 回复

Hi Christy

I am not sure what is generating these emails to the admin. How are the users being created - is there an external authentication plugin being used?

What is the content of the notification - is it a new user notification or new enrolment ?

Regards

永久链接 | 显示父帖子 | 回复

These are users who are self-registering for new accounts. The admin is getting a copy of every "Account request approved" email.

They follow this template:

Dear NAME,

A new account has been created at 'SITENAME' as requested.

You may login via the following link

URL

Your username is: USERNAME

If you need help, please contact support at this address: ADMINEMAIL

永久链接 | 显示父帖子 | 回复

Hi Christy

There are 2 self registration plugins available -

email based self registration - where only the user should receive an email to confirm their account
Self - registration with approval - the user receives email - the approver goes through a pending request list to approve the account an email shouldn't be generated to the approver. This sounds like the one you are using

Can you confirm whether you have any additional plugins showing under Plugins Overview - the self registration plugin could be a third party plugin?

Regards

永久链接 | 显示父帖子 | 回复

It's self-registration with approval because many of our users don't have email addresses. The system is set up to generate a fake email address for each user if they leave that field blank when registering. However, we're not actually doing any manual approvals; it's configured to automatically approve all requests.

Is there a way to turn off the emails showing that the account was approved? I don't see anything within the configuration for that enrollment option.

永久链接 | 显示父帖子 | 回复

Hi Christy

This may be a daft question but, are you using individual email addresses for users or one common email for all new users?

I only ask because all of our new users initially get our administrator's email address as default, this means that we get all the notifications destined for the individual, until their own email address is applied to their account.

Thanks, best regards

永久链接 | 显示父帖子 | 回复

That's a good question, but no--each user has an individual email address. A lot of our users don't have email addresses (or only have personal email addresses), so the system is configured to generate a unique email address for each user.

永久链接 | 显示父帖子 | 回复

Hi Christy

I don't know how much sway you have with implementation of the system, but it is my understanding that this way of doing it "However, we're not actually doing any manual approvals; it's configured to automatically approve all requests." is a highway for hackers into your system.

Craig, any input on this please?

永久链接 | 显示父帖子 | 回复

Hi Paul

This does sound pretty open accepting any user to create an account even users without emails

The self registration with approval does have some safeguards to automatically approve emails from specified domains so could include the generated email domain and the organisation domains.

There is also RECAPTCHA available to help prevent robots from creating accounts

Regards

永久链接 | 显示父帖子 | 回复

The specific implementation includes using vanity URLs that redirect to include data on the tenant and audience for self-registration. On the back end, our Totara partner has it set up to do the automatic approvals when they are in those audiences. It's much less likely that hackers would come up with a URL that includes the ?aud=AUDIDHERE&tenanttheme=themeid at the end. Frankly, if they do, and we see that it's a problem, it will be an issue for our Totara partner to resolve, as this was their solution to the fact that we have users without email addresses. And honestly, if someone registers at the base URL without one of those codes, they won't become part of a tenant and won't have access to any training content. A learner account that gets access to an empty default dashboard can't do much damage. Thanks for the warning though.

永久链接 | 显示父帖子 | 回复