CiviCRM Community Forums (archive)

*

News:

Have a question about CiviCRM?
Get it answered quickly at the new
CiviCRM Stack Exchange Q+A site
This forum was archived on 25 November 2017. Learn more.
How to get involved.
What to do if you think you've found a bug.



  • CiviCRM Community Forums (archive) »
  • Old sections (read-only, deprecated) »
  • Support »
  • Using CiviCRM »
  • Using Profiles (Moderator: Dave Greenberg) »
  • Dublicate matching on Drupal registration profile
Pages: [1]

Author Topic: Dublicate matching on Drupal registration profile  (Read 3836 times)

idmacdonald

  • I post occasionally
  • **
  • Posts: 69
  • Karma: 1
Dublicate matching on Drupal registration profile
March 23, 2011, 10:53:54 am
Hi,

I am using CiviCRM  v29586 and have a profile with a few fields set to appear on the Drupal user creation form. However, in that context, the profile options with regard to duplicate maching 'Issue warning and do not save', 'Update the matching contact' and 'Allow duplicate contact to be created' don't seem to work as I expected.

No matter which three options I select, creation of a Drupal account with an email address that exists in the CiviCRM database will cause the Drupal user to be associated with the CiviCRM contact record.

Furthermore, any information entered in the user registration profile fields will overwrite the values that are already in CiviCRM. This seems like a security problem to me. If I allow anonymous browsers of the site to create Drupal user accounts for themselves, then potentially any CiviCRM contact that doesn't yet have a Drupal user can be altered by someone entering the contact's email address on the Drupal registration form along with bogus information in the profile fields.

I have a large membership database, and so far we have created batches of Drupal users for the people in the CiviCRM database. But I'd like to allow people already in the database to create user accounts for themselves, but only if workflow can be set up in a safe and secure way.

Have other people had this problem? Am I mistaken in my understanding of how contact-user matching happens when Drupal user accounts are created?

Thanks,
-Ian

petednz

  • Forum Godess / God
  • I’m (like) Lobo ;)
  • *****
  • Posts: 4899
  • Karma: 193
    • Fuzion
  • CiviCRM version: 3.x - 4.x
  • CMS version: Drupal 6 and 7
Re: Dublicate matching on Drupal registration profile
March 23, 2011, 11:57:00 am
Do you have EMAIL field in your Profile - i think that even though it doesn't show in the Profile because Drupal Reg provides the field, it needs to be set in the CiviCRM profile.

If that is right then perhaps something could be done to ensure a Warning shows if a Profile is set to 'use for Drupal reg' - if the above is rubbish then perhaps a Warning could be attached to my responses
Sign up to StackExchange and get free expert advice: https://civicrm.org/blogs/colemanw/get-exclusive-access-free-expert-help

pete davis : www.fuzion.co.nz : connect + campaign + communicate

idmacdonald

  • I post occasionally
  • **
  • Posts: 69
  • Karma: 1
Re: Dublicate matching on Drupal registration profile
March 24, 2011, 03:46:13 am
Hi Pete,

I didn't have an email field in my profile. However, I have added one, and the behaviour seems to be the same. Upon creation of the Drupal user, the Drupal account is always linked to the contact with the same email address, if one exists. And any other data entered on the registration form will overwrite the information already stored for that contact.

So, the 'What to do upon duplicate match' settings seem to have no effect if the profile is used for Drupal user registration, and the security problem with data potentially being maliciously overwritten still exists. Has anyone else had this problem? I only want to capture a small amount of information on the registration form, but I can't see a way to safely to do so at the moment.

Thanks,
-Ian

Donald Lobo

  • Administrator
  • I’m (like) Lobo ;)
  • *****
  • Posts: 15963
  • Karma: 470
    • CiviCRM site
  • CiviCRM version: 4.2+
  • CMS version: Drupal 7, Joomla 2.5+
  • MySQL version: 5.5.x
  • PHP version: 5.4.x
Re: Dublicate matching on Drupal registration profile
March 24, 2011, 07:11:44 am

hey ian:

this comes up periodically and so far have not come up with an easy clean solution. However your solution of using the "profile settings" to control this behavior seems to potentially be a good way to handle this

So if we do find a match and the profile settings are not: "Update the matching contact", then we basically fail the validation and prevent user creation or create a duplicate contact for this user (based on what setting was chosen)

would be great if you can investigate and potentially provide a patch for this. A fair amount of the code should already be present

lobo
A new CiviCRM Q&A resource needs YOUR help to get started. Visit our StackExchange proposed site, sign up and vote on 5 questions

idmacdonald

  • I post occasionally
  • **
  • Posts: 69
  • Karma: 1
Re: Dublicate matching on Drupal registration profile
May 03, 2011, 08:21:42 am
Hi,

I have looked at some of the relevant code which could be used to get the duplicate matching on user registration working, though I still don't have a clear idea of the amount of time it might take to do the coding.

I suppose this issue still exists in CiviCRM 3.4 and 4.0. Or has some progress been made on this issue with the latest releases?

Thanks,
-Ian

Donald Lobo

  • Administrator
  • I’m (like) Lobo ;)
  • *****
  • Posts: 15963
  • Karma: 470
    • CiviCRM site
  • CiviCRM version: 4.2+
  • CMS version: Drupal 7, Joomla 2.5+
  • MySQL version: 5.5.x
  • PHP version: 5.4.x
Re: Dublicate matching on Drupal registration profile
May 03, 2011, 10:49:02 am

yes, this issue still exists

lobo
A new CiviCRM Q&A resource needs YOUR help to get started. Visit our StackExchange proposed site, sign up and vote on 5 questions

FatherShawn

  • Ask me questions
  • ****
  • Posts: 372
  • Karma: 25
    • C3 Design
  • CiviCRM version: 4.2.11
  • CMS version: Drupal 7.23
  • MySQL version: 5.5.32
  • PHP version: 5.3.10
Re: Dublicate matching on Drupal registration profile
May 08, 2011, 06:29:27 am
This code was written some time ago but also deals with this issue.  Perhaps it will give some inspiration?
http://drupal.org/project/civiregister

Lead Developer, C3 Design.
Twitter: @FatherShawn

pkeogan

  • I post frequently
  • ***
  • Posts: 130
  • Karma: 4
    • BackOffice Thinking
Re: Dublicate matching on Drupal registration profile
August 23, 2012, 08:53:07 pm
This profile issue is still a battle in 4.2.  We constantly get questions on best practices... today I got the email oh my... my records are are being over written by profile....

It seems that almost all civi users have the same issue -- Other CRMs have the same issue.

I don't have the best answer....we generally tell people to have a good dedupe process and review their specific situation :)

Key to know: When submitting a profile (like a subscribe link) the profile uses the default Fuzzy rule to check for duplicates NOT the default strict rule (strict rules are used for events/membership/donations)  -- when profiles are used in conjunction with events/membership/donations, then the strict rules are utilized.

Dangerous profile-like thing that we see creating lots of issues:  On donations, giving a memorial/honoree gift does a match (using strict default match) and will update the name of the honoree contact record.  Yikes.   Since most of the time the strict match is on email, so this is also a great way to get tons of duplicates with the same name.  Yikes again.  We always advise against using this feature and recommend creating a separate profile (less functionality, but better data)

Most people don't understand and as implementors  we need to ensure we review it when they start using any new features on line.

We have done some customizations around this for multiple person event registration -- so that the profile never updates the information of anyone not logged in.

And yes Lobo -- we (BOT)should create a fix for this....

sonicthoughts

  • Ask me questions
  • ****
  • Posts: 498
  • Karma: 10
Re: Dublicate matching on Drupal registration profile
April 19, 2013, 02:13:03 pm
I can confirm this behavior on 4.2.8

Donald Lobo

  • Administrator
  • I’m (like) Lobo ;)
  • *****
  • Posts: 15963
  • Karma: 470
    • CiviCRM site
  • CiviCRM version: 4.2+
  • CMS version: Drupal 7, Joomla 2.5+
  • MySQL version: 5.5.x
  • PHP version: 5.4.x
Re: Dublicate matching on Drupal registration profile
April 19, 2013, 02:30:46 pm

Still waiting on BOT for an issue and patches for this :(

lobo
A new CiviCRM Q&A resource needs YOUR help to get started. Visit our StackExchange proposed site, sign up and vote on 5 questions

sonicthoughts

  • Ask me questions
  • ****
  • Posts: 498
  • Karma: 10
Re: Dublicate matching on Drupal registration profile
April 19, 2013, 02:33:17 pm
Really hard to track down what is going on.  Perhaps better ui messages (the fuzzy vs. strict based on type of profile match was lost on me.)  Frankly, I never really know how to implement this for anon users - great way to keep the db updated, but easy to turn into mush :)
Pages: [1]
  • CiviCRM Community Forums (archive) »
  • Old sections (read-only, deprecated) »
  • Support »
  • Using CiviCRM »
  • Using Profiles (Moderator: Dave Greenberg) »
  • Dublicate matching on Drupal registration profile

This forum was archived on 2017-11-26.