How to disable and wipe offers?

[kontrabass]

Hi Bob,

We had a mass scam event where spam accounts post "offers" to ads with links to 'verify' their payment. I'm trying to disable the offer system. When I spam clean a user i cannot delete their offers. Can I empty them via mysql and can you help with that query? This is a huge mess.



xyz made an offer on your classified ad at TalkBass.com.

Traynor SB 112 combo​

Offer price: $475.00
Offer expires Nov 18, 2025 at 10:12 PM
Hello,

Thank you for using TalkBass.
To continue with your current transaction, we ask that you complete a quick seller verification.

Please follow the link below to complete the verification process:
SCAM LINK REMOVED

If the link does not work, please copy and paste it into your browser's address bar.

This step helps to ensure the safety and reliability of our platform for all participants. Once the verification is complete, your transaction will continue automatically.

If you have any questions or need assistance, please contact our support team.

Thank you for your cooperation.
TalkBass Support Team

 

[kontrabass]

Also, I have every "offer" permission set to NEVER, but new spam accounts are registering and sending offers as I type this

I did a "delete from xf_xa_cas_offer; to wipe 800 scam offers out of the database.

 

[Bob]

Also, I have every "offer" permission set to NEVER, but new spam accounts are registering and sending offers as I type this

Posting offers are permissions based. If they don't have permission, there is NO WAY that they are able to post offers. Their FINAL permission must be TRUE otherwise they can't post. Its no different than all the other permissions that allow the viewing user to do something.

I did a "delete from xf_xa_cas_offer; to wipe 800 scam offers out of the database.

You need to perform cache rebuilds as COUNTS in parent records need updating.

When I spam clean a user i cannot delete their offers.

Start a suggestion so that I can implement a Spam Cleaner Handler for offers.

 

[kontrabass]

Thanks Bob. I finally figured this out. The scam bots are newly registered accounts in the "awaiting email confirmation" state. I saw the little note in the admincp that this means they inherit the "unregistered" group permissions. I checked the unregistered group permissions and sure enough, they had access to make offers.