I only discovered XoopS a few days ago and just did the upgrade. It was clear to me in the Readme to update the System. Worked just fine.

But, you will want to visit your modules and check your settings after doing an Update since the process returns many things back to default. I found that pretty quick when I saw or didn't see things as my test user that were in place before the upgrade. Same thing when doing an Update for other Modules anytime.

It is wise to document your custom settings before any upgrades or module updates. Hey, how about a 'Current Config' report function? System wide or per module reports. It can take a while to remember where that little setting is that makes things act as you wish.

I say yes to getting this up to date. I'd say this will get fixed in the core (Module?). Private should mean private. The rumour mill that starts when people can't get into what is listed is universal. Letting them read but not post is fine if it is clear why. But don't tease them with topics they can't even read.

Great product BTW. I just discovered XoopS.

Ugly topic indeed, never ending job. If you have the time to approve regs then you should activate admin approval, not allow uploaded/linked avatars, and grab as much info as you can in the email sent.

IP isn't enough or useful for banning most of the time but you should keep it anyway and store the really bad boys away. You'll find that some of these clowns do it from an office and presenting that company with your evidence goes a long way.

I'd like to see email address banning (with wildcard) along with IP. Still not enough to keep away most trolls but it makes them work harder creating new addresses just to bug you.

Maybe even user tracking so that activity for a specific user can be easily extracted in a report for those times it could help.

Chasing abusers isn't even good sport anymore. Too much grief.