Category: User Administration (Registration, Login & Banning)

To reproduce:

1- visit as anonymous:
http://doc.tikiwiki.org/tiki-editpage.php?page=dhsgfkjsd&quickedit=edit

2- Click login
http://doc.tikiwiki.org/tiki-login_scr.php

and login

3- I am sent to:
http://doc.tikiwiki.org/tiki-editpage.php

instead of the page I was trying to edit:
http://doc.tikiwiki.org/tiki-editpage.php?page=dhsgfkjsd&quickedit=edit

{syntax type="tiki" editor="plain"}
{CODE(caption="tiki-login.php line ~308")}if ($prefs['limitedGoGroupHome'] == 'n' || $url == $prefs['site_tikiIndex'] || $url_path == $prefs['site_tikiIndex'] || basename($url_path) == $prefs['site_tikiIndex'] || ($anonymous_homepage != '' && ($url == $anonymous_homepage || $url_path == $anonymous_homepage || basename($url_path) == $anonymous_homepage)) || ($tikiIndex_full != '' && basename($url_path) == $tikiIndex_full)) {{CODE}

for $prefs['limitedGoGroupHome'] == 'y'
the sefurl will not match

I added this here because there have been no responses in the forum. The category is support request, and I assume this does not mean request for paid support.

See https://tiki.org/tiki-view_forum_thread.php?comments_parentId=77291#threadId=77544

Maybe this can be handled by a new developer to the project.

Levels in tiki-assignpermission.php are confusing to the new tiki admins.

Homework feature has been kicked out - but the permissions are still in there, when looking at

Admin -> Groups

Hi there,
I would like to know if it is possible to force the tikiwiki login process.

I want the login page for the home page, in order to force the users to log in. I have to modify the tiki-index page ?Do you guys have any hint for doing that?

Any help will be much apreciated.
Luca

Hold on, trying to reproduce on show...

__Update__: OK, it worked Please ignore. Closing and deleting.

__Update 2__: Well, actually it turned out that the "culprit" was adding the IP address to whitelist of the server requesting the FB login to Facebook App Advanced tab. Re-opening the item and re-categorizing, because I feel, Tiki should support that and not fail with the login attempt when someone sets that up on the FB App side.

Problem: people forget their username

So Tiki has a feature to let people use their email as username. So far so good. But when people start using collaborative features, their email is disclosed (not good)

Perhaps Real Name could be shown instead of email/username?

There is a risk of confusion though because Real Names are not enforced to be unique.

Imagine a site where users can register themselves,a nd select to be just simple registered users, or to join "Comission A" in adition.
Group "Registered" has tracker 1 linked to it, and set to request some fields from it at registration time.
Group "Comission A" has tracker 2 linked to it, and set to request some fields from it at registration time.

And imagine that we want to allow the users initially registered just to "Registered" group, can join themselves the group "Comission A" later on, if they wish. We could use the SUBSCRIBEGROUP plugin for that (nice plugin!)

However, when user clicks on the "subscribe" button, he/she is not requested to fill in the tracker item needed to join that group, but nothing else and sees the same wiki page instead.
For consistency, that user should be directed to the tracker item insertion for that tracker2, so that all users from that group have filled the required fields, agreements (on checkboxes), etc.

Hello,
Installed tikiwiki 1.9 on a CentOS 4.4.
Assigned autenthication to external LDAP server ( Windows AD ) , but the problem
remains even with IMAP.
Login with admin works
Login with external users presents again the login screen ( no "bad password" just the login screen again and again )

I debugged the code and found the both IMAP and LDAP modeles correctly check the user
and at the end of tiki-login.php the "tiki-user-tikiwiki" Cookie is set with the IMAP/LDAP username, but then at start of "tiki-index.php" the $user variable is empty.
A further check states that session_id() at the end of tiki-login.php is different from session_id() at start of tiki-index.php ( and this explains why the value of variables are different ).
10 correct authentication produce 10 different PHPSESS file with correct username but tiki-index.php always load the first one ( without username set ).

This has been reproduced with php-4.3.9-3.22 on a Centos 4.2, 4.3 and 4.4

http://en.wikipedia.org/wiki/Gravatar
http://en.gravatar.com/site/implement/images/smarty/


https://www.libravatar.org/

When importing a CSV list of users in the format login,password,email,groups,default_group,realName, when the user line group does not exist in Tiki, an error occurs.
{file type="gallery" fileId="1462" showicon="y"}

{syntax type="tiki" editor="plain"}
I have created a new site, and asked some people to try and register on it, and tell me anything that confused them.

And it seems there is something about the registration sequence of Tiki that can be confusing to end users.

In Tiki, the sequence (as I have configured it) looks like this:

A) User registers
B) Admin receives a notification
C) Admin approves
D) User receives a notification asking for him to confirm his email. He clicks on a link to validate that he controls that email.

Because I am the sole admin and am not at my computer all the time (I do sleep 8h a day ;-)), there can be sometimes a couple of hours between A) and D). This means that for many hours, the user no “persistent” confirmation that his registration request has been noted. To be sure, when you register, Tiki prints a message on the screen that says you will receive an email notification and that this can take several hours. But it doesn’t send you an email until the Admin has approved the account. So, for say, 12 hours, you are wondering what’s going on, and you don’t have anything anymore that tells you it’s being processed (because the Tiki message is now gone from your browser). It’s easy for people to start wondering “Did this REALLY work? Did I REALLY see that message from the server saying that I would receive an email message?”. This is what happend to my test user.

In most systems I have worked with, the sequence is more like this:

1) User registers
2) User immediately receives a notification asking him to confirm his email. User clicks on a link to validate that he controls that email.
3) Admin receives a notification that someone with a valid email has requested a registration
4) Admin approves
5) User receives a note that his account has been approved

With this sequence, even if the admin takes a long time to approve the request, during that time, the user has a PERSISTENT acknowledgement in his email inbox.

Another advantage of the later sequence is that we don’t bug the Admin until we know that the email address is valid. With the current approach, if a spammer tries to register with an email that doesn’t exist, the Admin will be asked to approve the account anyway, and we will end up with an account that exists, but was never validated.

Do people agree with this analysis? And if so, do we know how easy or hard it would be to change the order so that step D) happens right after A) instead.

Include a "Secret Question" functionality during the registration process to be used prior to Password Resets & Forgotten Passwords.

When people register to a Tiki site, they sometimes use their email instead of a username. While this works, there should be a warning that this email will be visible in wiki page history, etc.

There is an option to use email as username, but this should not be for community sites.


Other checks would be for accents, existing username, etc.

When a user is banned in the master site, he should also be banned on slave sites.

This could be an option, but general banning is OK too.

Seen on themes.tikiwiki.org , latest BRANCH-1-9

A new user (and spammer at that) logs in to themes.tikiwiki.org via InterTiki. He posts some spams, but Last login is "Never (3 hours)"

Currently, the Banning System interface (tiki-admin_banning.php) only allows IPv4-format addresses to be specified for matching purposes.

I believe this should be updated when convenient to enable IPv6 addresses to be specified, either as a new field ("IPv6 Regex Matching", with the existing field renamed to "IPv4 Regex Matching") or as a single field that allows both.

It appears from documentation that support for IPv6 in System Administration tables was part of the [https://doc.tiki.org/Tiki8#IPv6|Tiki 8 release]. Assuming I understand that correctly, this request should only require interface changes to be made.

At : tiki-admin.php?page=login
It is possible to enable "Use pretty trackers for registration form" without indicating a template in "Registration pretty tracker template". That lead to a broken registration page.

There should be a control mechanism to block/warn the user to apply without indicating a template.

{syntax type="tiki" editor="plain"}
If one is typing in the login hover and mouses out, no more typing is entered until one hovers over the login again.

After deleting spam, we can ((doc:Ban)) users but this should be easier/faster.


Ex.: after deleting a comment or rollbacking a wiki revision, have a link to ban the user.

Or maybe a "ban user" link from tiki-adminusers.php

{syntax type="tiki" editor="plain"}
With revision 31581 the LDAP group synchronisation has been limited to only happen 60 seconds after the login:

http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/trunk/lib/userslib.php?r1=31565&r2=31581&pathrev=31581

So far as I can see this method is only called during the LDAP login procedure, so the if-statement in line 1415 will always be false, thus no synchronisation will happen.

I checked this problem with 7.1, 7.2 and 8.3 and never succeded to get the groups from an AD although the LDAP login worked. After disseminating the code and removing this if-statement the feature works again.

I wonder what the the use of this if-statement was? The commit message refers to webdav changes - how does it affect this?
Can this statement be removed so LDAP group synchronisation works or is there another way to fix this?

I have encountered a few snags after upgrading from Tiki 1.9.11 to 2.0

One of the problems is that I am unable to register / add users, because of the following error message:

An error occured in a database query!
Unknown column 'email_confirm' in 'field list'

This happens on
tiki-register.php (registration) and tiki-adminusers.php (batch upload / add)

Is there a fix for this?

Seems like Tanzania keeps falling out of the country list. This was the case some years ago. Might as well add Swahili as a language option if applicable.