Joomla 4.3.X Validate a username on registration to NOT contain an @ symbol (notEmail)

Question

I have a situation whereby I want users to register on Joomla (using the standard J! registration form) using a 6-digit identification number that they have been given.

I have modified the Joomla login / registration field labels to prompt the user to enter their identification number as a username.

However people have still used an email address as a username (probably due to browser autocomplete). How can I prevent them from entering email into the username field and return false if a email is entered?

I don't know which joomla file to edit or if i should be using php or javascript to check the validation. Is there an override that can be done?

Answer 1

This should be addressed in the registration form, the backend function it calls, and any subsequent login attempts.

Registration Form

In the registration form, you can add some javascript to ensure there is no '@' symbol. Just create an override for the registration form and that should do. Either do it with Javascript, or change the input type to number for the user (if the pin is numeric):

<input type="number" ....

In order to create the override, go to System / Templates (site), click on your template and use the tab "Create Overrides", which will also tell you where it is saved.

The fields are defined in the form xml, you may not remove fields, but you can add some using the User Profile plugin. Never edit core files.

Backend

It seems there are no plugin events called upon registration, so either you intercept the call with a system plugin, or - way better - you use the override above to redirect the registration to your custom code to ensure nobody bypassed your frontend validation. This is just an extra check, as the part below will ensure it won't work even if the user manages to bypass your authentication checks.

Login function

When the user attempts to login, the authentication process goes through the authentication plugins in the backend, so you should create your own authentication plugin (i.e. your manifest should contain:

<extension type="plugin" group="authentication" ...

and just return false along with an error message so the user will know why it's not working:

public function onUserAuthenticate($credentials, $options, &$response)
    {
        if (!is_numeric($credentials['username']))
        {
            $response->status        = JAuthentication::STATUS_FAILURE;
            $response->error_message = JText::_('YOUR_CUSTOM_ERROR_TRANSLATED_STRING');

Of course this is very basic, you might want to add checks so that your admins can continue using alphanumeric logins, but this should give you all the entry points you need.