Verification code not found

Question

Joomla 3.9.23

I am also using RSFormPro for user registration (I have opened a ticket with their support also).

When a user registers on my site they receive an email with a link to verify their account, when clicked, they are redirected to ,registration/staff/registration-messase where a html message (configured in rsform pro) is displayed. Then another email is sent to an administrator containing a link to approve this users account.

The issue i'm having is that some users are seeing an error when clicking the verification message in the email, the message is;

403 Verification code not found.

The menu item registration/staff is set to public im not sure if this makes any difference, should it be set to guest?

I have received a copy of the emails and tried clicking the link myself, same error. I have checked the joomla user manager and can see the users are there, just not enabled or activated.

So, why am I seeing this 403 error?

Is it because the link has already been clicked? Clicking this link more than once results in this error. Users are insisting they are clicking it just once. Which must be true because the second email to admin is being sent.

As I understand this link is a 'one time only' link, and should only display the 403 error in the event that the user has already clicked the link?

How can I troubleshoot / investigate?

Answer 1

I suspect that because you've got the 403 error message "Verification code not found" that the request is actually being rejected by Joomla itself. The language string COM_USERS_ACTIVATION_TOKEN_NOT_FOUND is set on my instance to "Verification code not found. Check if your account is already activated and try to log in.".

Looking at the Joomla code in com_users/controllers/registration.php in the activate() function this error is raised if the $model->getUserIdFromToken($token) call does not return a user to activate.

To find the user to activate the Joomla registration model (com_users/models/registration.php) does a SQL query:

$query->select($db->quoteName('id'))
        ->from($db->quoteName('#__users'))
        ->where($db->quoteName('activation') . ' = ' . $db->quote($token))
        ->where($db->quoteName('block') . ' = ' . 1)
        ->where($db->quoteName('lastvisitDate') . ' = ' . $db->quote($db->getNullDate()));
$db->setQuery($query);

so you'll get the error if this query returns no rows.

I suggest you try doing this SQL query directly on your database and see if it returns the row that you expect (whenever you're in the middle of registering a new user).

If you're using RSFormPro for the registration form are you sure you're setting all the database fields in the users record correctly?

I guess the other alternative is to check if the admin is setting the user to Enabled before they've even confirmed the account using the link.

Answer 2

A 403 error indicates that the access is forbidden.

Usually it's either blocked by a firewall (e.g. admin tools, RSfirewall, or mod_security on the server), or by rules in your .htaccess file.

See what the activation link looks like and then allow that link in your .htaccess and/or check your firewall logs and disable any rules that could block that request.