15
Why I find fake/spam registered users in my site…?
The majority of such registrations are coming from botnets, infected machines, script kiddys and generally all kind of bots.
In systems like Joomla, where the location of the user registration form is well known and by default public accessible, it's easy to start filling up and submitting the forms.
...
14
Ideally, this will all be done in a user plugin. I'm not sure that a lot of people realize this, but you can edit the form from a plugin (no core hack required).
Likewise, the plugin will see the input before the model attempts to save the entry, so you can mock some of the field duplication fields to force it to pass the validation.
This fuction in a "...
14
The main reason for 3.6.4 update was exactly what happened to you!
Security Bulletin [20161001] - Core - Account Creation states
"Inadequate checks allows for users to register on a site when registration has been disabled."
Then, additional vulnerability which was fixed by 3.6.4 was [20161002] - Core - Elevated Privileges "Incorrect use of unfiltered ...
11
Newer versions of Joomla 3.x disable User Registration by default.
If your version of Joomla was installed before this change, you probably have User Registration enabled.
User Registration can be disabled by setting Users -> Manage -> Options -> Allow User Registration to "No".
You can then delete all users except the Super Administrator account....
9
Ok so I was thinking about an approach without having to core hack anything or install any 3rd party extensions. My method will involve a Template Override which you will need to make for the com_users component, specifically the Registration view.
Now for the fields (assuming your template override is all setup), we won't be removing them, but instead ...
6
There are two ways you can do for that (both are safe from Joomla update / you won't loose the changes when updating your Joomla)
1. By using template override
Copy the file /components/com_users/views/registration/tmpl/default.php
to
/templates/your_template_name/html/com_users/registration/default.php
then open it with your favorite php editor.
...
4
I know the recommended way of doing this is writing a plugin for. But I did remove repeat email and repeat password fields with a js trick:
jQuery(function ($){
$("#jform_password2-lbl").parent().hide();
$("#jform_password1").focusout(function () {
$("#jform_password2").val($(this).val());
});
$("#...
3
I'm not real familiar with Chronoforms anymore, but if you can get this code in there somewhere, the user should be logged in:
$credentials = Array('username' => 'MyUsername', 'password' => 'MyPassword');
JFactory::getApplication()->login($credentials);
3
Well, this solution doesn't sit well with me, but it does work using the user plugin:
public function onUserBeforeSave($oldUser, $isnew, $newUser) {
if($test == 'fails') {
$error = ' First and Last Name must be specified';
throw new Exception($error);
}
}
3
From the dropdown menu in the admin side of your website, go to Users -> User Manager. Then in the upper right, click "Options".
One of the first few items in the options list should be "New User Registration Group", which you can adjust to be the user group that you want new users to be added to.
3
I've got it!!!
You have to include:
JHtml::_('behavior.framework');
and the javascript is something like this:
jQuery("#user_name").attr('title','Kérem előbb válassza ki a hatályba lépés dátumát!');
jQuery("#user_name").tooltip('show');
Make sure that these two line are in the done method of your jquery ajax call.
Then you have to destroy it:
jQuery("#...
3
Registration message comes from Language Variable defined in com_users language file:
\language\en-GB\en-GB.com_users.ini
Replace en-GB with your desired language code of course.
You should search your message in the above file and instead of directly editing .com_users.ini which might get overwritten in next joomla update, you should create language ...
3
Write user plugin which will have the below file structure
plugins/user/plugins_name/
plg_add_group.php
plg_add_group.xml
plg_add_group.xml
- Write plugin manifest code here you can refere below link for the same. https://docs.joomla.org/J3.x:Creating_a_Plugin_for_Joomla
plg_add_group.php : Write below php code in this file.
<?php
defined('...
3
Briefly, these are your main options:
Write a custom user registration component
Write a User Plugin that will handle the usergroup of the registered users
Use 3rd party Form extensions which integrate with JUsers and create your custom form(s)
A few form extensions that work well for this use case:
RSForm pro with its JUser/Registration plugin,
Fabrik
...
2
@DavidFritsch's answer was very helpful. A couple of problems I found though were:
A) You can't completely remove certain mandatory fields as it causes problems with data filtering on form submission (see comments in the code below). To combat this, hide rather than remove the fields from the form object.
B) The onUserBeforeSave event is not fired until it ...
2
According to this page, what you describe is the default behavior when you set user registration to "Admin":
Admin
It is necessary that an administrator approves the account. Here is
how the process goes:
After registering the new user receives an e-mail message containing a link with a token to verify their e-mail address;
After the ...
2
To only change the message, you only have to:
Visit Extensions / Language Manager / Overrides
New
Language Constant: COM_USERS_ACTIVATION_TOKEN_NOT_FOUND
Text: This user has already been verified
To add the date of previous activation, it's not directly possible, since it's processed by a com_users controller and an associated model. In the case of the ...
2
How to disable front-end Language option:
In the backend, Click to Users menu item (com_users).
When in Users manager, click the Options button (top right).
In the Configuration of the users component, around the middle there is the option to Hide the Front-End Language.
However, from your question I understand that while you don't want the user to have ...
2
Follow below procedure.
Go to Users->User Manage
Click on Options button on toolbar
Set "New User Account Activation" option to "Admin"
Enable "Notification Mail to Administrators" option (optional)
Please note that users still need to verify their email address, though activation will be done by admin.
2
This is more of a suggestion than an answer, but you can learn a lot by looking at other extensions to see how they solved the issue. A component called Facebook Graph Connect seems to do something very similar to what you're trying to achieve (automatically logging in using a Facebook account and a random password).
Download the extension, install it on a ...
2
Let me start by saying I do not condone this method, the next time you update Joomla there is a high probability you will undo these changes completely.
This is however a working method to do what you are trying to accomplish.
Edit the file components > com_users > models > forms > registration.xml
Comment out the name field
<!--<field
name="...
2
Finally got a workaround.
require_once JPATH_BASE/components/com_users/modes/registration.php
$obj = new UsersModelRegistration();
$form = $obj->getForm()->getXML();
This gives the complete form which includes the core registration form with all other custom profiles.
2
In file /templates/theme1155/css/template.css
on line 299 in selector #rt-login-button add attribute display:none like this:
#rt-login-button {
text-align: right;
display: none;
}
UPDATE:
This solution doesn't remove registration links, just hides them from module's html output (doesn't display them), which is is more than enough most of the time....
2
I don't know the plugin and am not entirely sure I can think what you might have in mind that concerns you about a possible failure of this.
But my logic says that if a function fails under any possible conditions that could lead to a function fail, then it won't complete its operation, therefore we won't get the expected outcome.
In the case of the ...
2
User plugin's onUserAfterSave function does not return any value, means there will be no action taken by calling function based on result of this function.
In core registration, the user will be saved irrespective of the result from onUserAfterSave function. So if your logic fails in this function, the user will still be saved, although your user group ...
2
The text is the HTML of the email. You can have HTML code in that text formatted the way you want. There is no other place where you can actually change the HTML of that email.
Update: Open the components/com_users/models/registration.php file and add true at the end of each and every JFactory::getMailer()->sendMail function call. For example, you should ...
2
You really don't need to install third-party plugins for this.
Just create template override for com_users registration and there you can hide username field and copy email field value into this field on form submit.
so this is gone be pure Joomla solution,
do it like this:
go to http://katalog.dev/administrator/index.php?option=com_templates&view=...
2
I don't think there is a way, within the Joomla core, to force a password reset. There are quite a few extensions for that sort of thing though.
The activation value wont do anything, I think, if you're creating a user from the JUser object.
I think the sendEmail parameter should work, in terms of sending the user their details. Check the options in User ...
2
There are many possible ways that the hacker has broken into your web,
I recommend you see these documents:
https://docs.joomla.org/Security
As to your question I would bet that the hacker could somehow upload a file to your website with a script that creates the user directly into the database.
With knowledge of Joomla tables and function it is ...
2
Preventing fake accounts can be tricky. ReCaptcha v2 will work to a certain extent but is still not a 100% solution.
What I would suggest doing is going to the User Manager Options and setting the New User Account Activation to Self. This will ensure that users need to activate their account via email, until then, their account will be disabled.
You can ...
Only top voted, non community-wiki answers of a minimum length are eligible
