I have had a problem with a spammer registering fake users to send spam around.
The method used is to set the user name to something like "Yesterday I published this awesome video http://something.wow/spammer/video which you should come and see!" and the mail address to the spammer's target. One new registration every 5 minutes.
First, I tried to enable captcha. No way. Then invisible captcha. Again, no way. Don't ask me why, I have no idea, but the spamming did not stop.
Last, I tried to put a length limit on the username (10 characters would do). After reading the official info on server-side form validation I found that it is not perfectly in sync with the code, so I tried to read the code and I ended up with adding a
maxlength="10" attribute to the username field in the
registration.xml file. No way. When filling out the form, the browser in fact stops you from adding the eleventh character, but spamming continued. I suppose the spammer used a lower-level method to post the form, so the max length was not enforced.
- Why captcha does not work?
- Why the maxlength attribute does not force server-side validation?
- Why obvious checks like max user name lenght and sane characters are not the default in Joomla 3.9?
- Is it possible to add validation yourself and, do you have a working example?