Take the 2-minute tour ×
Drupal Answers is a question and answer site for Drupal developers and administrators. It's 100% free, no registration required.

I'm manually creating a user and then sending a notification email as follows:

$new_user = array(
  'name' => $username,
  'pass' => $password, 
  'mail' => $email,
  'status' => 1,
  'init' => $email,
);            

$account = user_save(drupal_anonymous_user(), $new_user);
 _user_mail_notify('register_no_approval_required', $account);  

However, the user is able to login right away. How can I enforce account activation? I have it enabled in the admin panel

share|improve this question
    
did you try status=0? –  MotoTribe Nov 11 '11 at 4:27
1  
According to api.drupal.org/api/drupal/developer--globals.php/global/user, setting the user status to 0 means the user is blocked. –  Omar Nov 11 '11 at 4:58
1  
yes, they are entered with status=0 until the email has been confirmed. I just created a user through the UI and checked the database, status is 0. –  MotoTribe Nov 11 '11 at 5:05
    
@mototribe - I tested this with a fresh install of Drupal 7, I see users status set to 1. –  Omar Nov 14 '11 at 16:08
add comment

2 Answers

up vote 3 down vote accepted

You can use the LoginToboggan Prevent preauth module is available for Drupal 6 and 7. And it realy does all the stuff. We can have "Email account activation without admin approval and also a user set password".

Code:

    $new_user = array(
      'name' => $username,
      'pass' => $password, 
      'mail' => $email,
      'status' => 1,
      'init' => $email,
      'roles' => array(logintoboggan_validating_id() => TRUE)
    );  
   $account = user_save(NULL, $new_user);
   // Send mail with account confirmation
   _user_mail_notify('register_no_approval_required', $account);

P.S. Don't forgot to uncheck 'Immediate login' option.

share|improve this answer
add comment

This can't be accomplished directly with Drupal.

When a user registers and 'email verification' is enabled for the website, Drupal creates a random password for the user and sends them a password reset link via email. The user CAN login, but that would require knowledge of the random password.

The only way I was able to accomplish this was by setting the users' status to 0, then sending a custom email with a link to a custom verification page. The link contains the ID of the user and a hash of a private key concatenated with the user's email. On the verification page, I pull the user's email from the database based on the ID in the URL, concatenate the private key to the email and hash it, if the hash matches the hash in the URL, I set the user's status to 1, enabling the user to login.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.