Author Topic: Problem with the (forced) option to create an account (Read 3100 times)

SFD · February 07, 2009, 12:48:46 pm

Hello,

I set up an online contribution page to allow visitors of my site to do sign up as members and add their contact details. This is working fine.

But I would also like to force them to create a joomla account at the same time. I upgraded to the 2.2.2 beta version and checked the 'Account creation required' box in the respective CivicRM profile.

However, when I load the contribution page (both at the back- and at the front-end), no username or password fields appear.

The only noticable thing is that the email address field appears at the top of the form, and not at its supposed location in the profile; and its label is changed. However, interestingly, this change happens independently of whether the option of the creation of an account is required, allowed, or denied.

Any ideas about what might be going wrong?

Here is how I link to the online contribution page (I do so from within an article, not from a menu):

http://www.esa.exre.org/joomla/index.php?option=com_civicrm&task=civicrm/contribute/transact&id=1&reset=1

The situation does not change if I add 'action=update'.

Thanks a lot for your help,

Fabian

Donald Lobo · February 07, 2009, 12:57:06 pm

can u enable registration for the site. We recently added a check to only allow registration if "user registration" is allowed in 2.2. This was at the request of some core joomla folks who felt this was a security whole otherwise

however, your use case does raise a valid question, IMO

. Folks might want to allow creation of an account only with a valid membership application and just disallow the normal registration

for the short term, you might want to hack: CRM/Core/BAO/CMSUser.php, line 170. (comment out the "return false;" statement)

lobo

SFD · February 07, 2009, 03:04:23 pm

lobo, thanks for the quick reply!

yes, both options work fine. i'll go for the hack since i don't want non-members to be able to register with joomla. though the hack is perfectly fine for me, i hope that you'll be able to convince the folks from joomla to rethink their request.

best,

fabian

mcsmom · February 07, 2009, 06:01:43 pm

If you don't want them to register with Joomla there are a couple of things you can do.
Make a layout override for the login module and also for the login page so that no link to the registration form is shown.
Also make an override for the registration page so there are no fields and just put a message or link directing them to where the form is.

SFD · February 13, 2009, 04:34:54 am

Hi mcsmom,

thanks for your reply!

I'd really like to keep joomla registration, since I have an intranet on my site for members, and I found that it was easiest to set this up with joomla authentication (actually, I couldn't get this to work with the civicrm authentication extension for joomla).

Anyway, I can live with the small hack, everything works fine!

Thanks,

Fabian

mcsmom · February 23, 2009, 02:40:56 am

If you have an intranet why don't you use LDAP or another authentication plugin?

jgaryt · March 07, 2009, 08:23:35 am

I agree with Lobo's opinion. I don't want people to be able to sign up without going through the membership form - no "free" signups. The Contribute form replaces the standard create account option for non-members.

lcdweb · June 22, 2009, 10:29:53 am

Just ran into this issue -- user account sign-up wasn't showing up on a profile and it was because user registration was turned off in the Joomla global settings.

I don't think the "security" concern is valid. For most people using a profile with signup, it's precisely because they want a membership or profile gateway to collect contact details and/or payment that they would include the user account registration on the profile and disable it in the main Joomla global settings (so non-members can't register).

Using template overrides in J! isn't satisfactory in my mind, because it hasn't actually locked down user registration -- it's just hidden the fields. That, in my mind, presents a greater risk of someone trying to hack in.

Another issue with the joomla account registration in profiles --
In order for it to work, the profile must include an email address field. But when the profile is included in a contrib page (membership signup) the email field is already required on that page. So the current behavior requires that field both in the contrib page section AND in the profile set itself (duplicated). The email check mechanism should only be used if the profile is used as a standalone signup/edit form.

Dave Greenberg · June 22, 2009, 01:09:24 pm

Hi Brian - Not sure what's the right thing to do for issue A ("user registration turned off"). My recollection is that we got some pretty strong objections from folks when we didn't have that check. in the short / medium term - if you want help figuring out how to disable that check for this install - let us know.

Regarding issue B - this seems like a usability issue and I think we should fix it (although it probably will need to wait for 2.4 given current backlog). Can you file an issue for this?

lcdweb · June 22, 2009, 02:57:29 pm

http://issues.civicrm.org/jira/browse/CRM-4669

Re: the allow user reg control --
in v2.2.6 -- CRM/Core/BAO/CMSUser.php
comment out line 176

(different line than what lobo quoted earlier in this thread, as he was referencing an earlier revision)

Who expressed concern? Was it on the forums -- I did a search and didn't see anything. Maybe I can convince them otherwise. The more I think about it the more I would argue that requiring the user account option on in global settings would *create* the security problem. The only *hole* I can think of would be that an unknowing admin user who is creating a profile could include those fields when maybe they shouldn't. But I think that's a low risk.

Donald Lobo · June 22, 2009, 11:54:06 pm

can u chat with elin waring (mcsmom) and talk it out with her

lobo

mcsmom · June 23, 2009, 02:16:08 pm

This patch will disable front end core registration even if global configuration allows it.

I put this on the Joomla tracker here; we will see if it flies.

http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=16942

If you test please leave a comment.

CiviCRM Community Forums (archive)

News:

Author Topic: Problem with the (forced) option to create an account (Read 3100 times)

SFD

Problem with the (forced) option to create an account

Donald Lobo

Re: Problem with the (forced) option to create an account

SFD

Re: Problem with the (forced) option to create an account

mcsmom

Re: Problem with the (forced) option to create an account

SFD

Re: Problem with the (forced) option to create an account

mcsmom

Re: Problem with the (forced) option to create an account

jgaryt

Re: Problem with the (forced) option to create an account

lcdweb

Re: Problem with the (forced) option to create an account

Dave Greenberg

Re: Problem with the (forced) option to create an account

lcdweb

Re: Problem with the (forced) option to create an account

Donald Lobo

Re: Problem with the (forced) option to create an account

mcsmom

Re: Problem with the (forced) option to create an account