Joomla 3.6 has two different controllers intended to create a new user:


defined in components/com_users/controllers/registration.php and


defined in components/com_users/controllers/user.php

Looking at their source code, both the methods looks like very similar, and do the same job.

Nevertheless, while the former is used for user self registration, it seems that the latter is not used anywhere.

I just want to know whether UsersControllerUser::register() is actually unused code or no.

I'm a bit worried since even if it's unused by the Joomla views, the task is still callable by a malicious request.

  • 4
    There are some differences between the two - the first one actually checks if the registration is allowed or not. Your question, is however, a valid question, and I will route it to the Joomla developers.
    – itoctopus
    Oct 10, 2016 at 12:10
  • 1
    Joomla 3.7 does't have UsersControllerUser::register() method
    – Pratyush
    Aug 4, 2017 at 8:02

1 Answer 1


It looks like leftovers from rebuilding the registration process. If you look closer it doesn't return in the code a proper message that depends on the activation method (admin, self, auto). And by the fact it was removed in the later versions I can safely assume it was a security/spam risk. So if you're still using the 3.6 version it would be good idea to update it, if not, you have nothing to worry about regarding this UsersControllerUser::register() task.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.