Abandonware user self-registration procedure in Joomla core

Question

Joomla 3.6 has two different controllers intended to create a new user:

UsersControllerRegistration::register()

defined in components/com_users/controllers/registration.php and

UsersControllerUser::register()

defined in components/com_users/controllers/user.php

Looking at their source code, both the methods looks like very similar, and do the same job.

Nevertheless, while the former is used for user self registration, it seems that the latter is not used anywhere.

I just want to know whether UsersControllerUser::register() is actually unused code or no.

I'm a bit worried since even if it's unused by the Joomla views, the task is still callable by a malicious request.

Answer 1

It looks like leftovers from rebuilding the registration process. If you look closer it doesn't return in the code a proper message that depends on the activation method (admin, self, auto). And by the fact it was removed in the later versions I can safely assume it was a security/spam risk. So if you're still using the 3.6 version it would be good idea to update it, if not, you have nothing to worry about regarding this UsersControllerUser::register() task.