We have recently noticed that unconfirmed users are not being deleted by the corresponding cron task. Our database was showing more than one hundred users with confirmed = 0, deleted = 0 since our upgrade from Moodle 2.7. Unfortunately, this prevents them to create a new account, because email addresses are already registered.
We have checked the code in lib/classes/task/delete_unconfirmed_users_task.php and we think we have found the bug in the SQL query that retrieves the users to be deleted:
$rs = $DB->get_recordset_sql ("SELECT * FROM {user} WHERE confirmed = 0 AND firstaccess > 0 AND firstaccess < ? AND deleted = 0", array($cuttime));
($cuttime is current time - deleteunconfirmed threshold, 7 days by default.)
All these unconfirmed users have firstaccess = 0 in database, because login/signup.php sets $user->firstaccess = 0 when the account is created. This way the AND condition is never matched. And this didn’t happen before upgrading because in Moodle 2.7 login/signup.php set $user->firstaccess = time(), i. e. account creation time, not zero.
If you are experiencing this problem too, could you please have a look at the tracker and vote for this bug to be fixed?
[MDL-54106] Delete unconfirmed users not working because firstaccess == 0