backdrop-ops / backdropcms.org

Issue tracker for the BackdropCMS.org website
https://backdropcms.org
25 stars 21 forks source link

Provide automatic purging of blocked/inactive accounts #914

Closed bugfolder closed 2 years ago

bugfolder commented 2 years ago

Currently, spammers create many accounts on the site and have been doing so for quite some time. There are many accounts that are created but never logged into, and many accounts are obviously spam from the fields they fill out at user registration and are blocked manually. There is a need to automatically purge users that have been blocked or inactive after some period of time has elapsed.

The newly ported module Auto Purge Users provides this capability. The PR (to follow) adds it to backdropcms.org. In the next comment, I'll talk about how we might configure it.

bugfolder commented 2 years ago

The configuration page for Auto Purge Users allows one to choose any combination of 4 criteria for purging user accounts either immediately or regularly via cron:

1) Purge user accounts that have never logged in but have existed for [time] 2) Purge user accounts that logged in at least once but have not logged in for [time] 3) Purge user accounts whose account has not been activated (i.e., currently blocked, never logged in) for [time] 4) Purge user accounts that have logged in but have been blocked for [time]

I propose that we turn on purging for 1, 3, and 4, with a time interval of 14 days for each. Note that this means any account that is not blocked and has logged in at least once would never be purged. This still includes a lot of (probably) spammer-created accounts, but if they don't actually post any spam, we can presumably ignore them.

Currently, there are 6248 user accounts on backdropcms.org. With those settings, 3073 accounts would be purged immediately. Subsequently, purging would happen via cron as accounts' inactivity/blockage passed the 14-day limit.

Thoughts?

yorkshire-pudding commented 2 years ago

I think those timescales and parameters are reasonable. It gives adequate time for someone blocked by mistake, as happened recently, to query and not have their account deleted. Thanks @bugfolder for all you do on this.

bugfolder commented 2 years ago

Seems like a decent amount of time has passed with no objections, so I'll proceed with merging the PR shortly.

stpaultim commented 2 years ago

I'm fine with your proposal @bugfolder - if a bit late in responding.