Category: User Administration (Registration, Login & Banning)

After upgrading from 1.9.11 to 2.0 an error occurs with a missing field (email_confirm) when trying to add a new user as summarised at the end of this post. This seems to be repeatable across several sites that I have upgraded from 1.9.11 so I am assuming something wrong with the upgrade script. Have checked the database using phpMyAdmin and whilst the field is present on a brand new install it is consistently missing in all the upgrades. Manually adding the field from phpMyAdmin rectifies the problem.

Would be very useful to have the full 2.0 data structure documented since I am seeing inconsistencies between the the number of tables in an upgraded site versus a new 2.0 site (upgrade had more tables) - some sort of test utility to validate the data structure would also be very very useful.



__ERRORS RECEIVED WHEN TRYING TO ADD A NEW USER:__

An error occured in a database query!

Context:
File tiki-adminusers.php
Url tiki-adminusers.php
Query:
insert into `users_users`(`login`, `password`, `email`, `provpass`, `registrationDate`, `hash`, `pass_confirm`, `email_confirm`, `created`, `valid`, `openid_url`, `lastLogin`, `waiting`) values(?,?,?,?,?,?,?,?,?,?,?,?,?)
Values:
0 testuser
1 testuser99
2 admin@enmoreservices.com
3
4 1221214268
5 $1$9LOB42RB$ZHSl8Al4i9Aw4KcLnHlpa.
6 0
7 1221214268
8 1221214268
9 NULL
10 NULL
11 NULL
12 NULL
Message:
Unknown column 'email_confirm' in 'field list'
Built query was probably:
insert into `users_users`(`login`, `password`, `email`, `provpass`, `registrationDate`, `hash`, `pass_confirm`, `email_confirm`, `created`, `valid`, `openid_url`, `lastLogin`, `waiting`) values('testuser','testuser99','admin@enmoreservices.com','','1221214268','$1$9LOB42RB$ZHSl8Al4i9Aw4KcLnHlpa.','0','1221214268','1221214268',NULL,NULL,NULL,NULL)

There is a module named "New User Registration" with the explanation "Permit anonymous visitors to create an account on the site". But as soon as you try to add this module anywhere (being admin, of course) you are immediately thrown onto the home page with an error message "You are logged in".

Perm plugin is very useful and works well. It is very similar to the group plugin. It weighs just a few k and I see no advantage of putting in mods.
http://mods.tikiwiki.org/details.php?type=wikiplugins&mod=perm

Similar to group plugin, we need "if/else" concept:
http://dev.tikiwiki.org/tiki-view_tracker_item.php?itemId=994

So we could do things like this in wiki pages:
if tiki_p_edit "please click here to edit" else "please click here to login"

Also, group plugin is still in mods, but already in main code base so it should be cleaned out of mods.

Using 1.10cvs from the last week of October'07.
Multiple assignment of users to a group is not working. Log shows as if those users were effectively assigned to group Editors (in my case), but after that, when I refresh the list of users, those users are still only belonging to registered group, and not Editors.

However, if I assign one by one, through the key icon, they are well set to the Editors group.

http://moviments.net/intercanvisarxius/

(this is the same site as http://intercanvis.net but for testing, using latest 1.10 cvs code)

Hello, I have been receiving this error ever since I upgraded to 2.0 (I have since upgraded to 2.1 and then 2.2). When I try to add a new user, I receive this MySQL error message. I have not found any workaround.

I did a clean install and clean database install and was unable to duplicate this error that way.
MySQL version 4.0.18 local on a Suse OES 1 box. TikiWiki 2.2, started occuring in 2.0.

{img src=show_image.php?id=62}



Thanks for the help!

Any idea what could cause "Never logged in" message on all hovered user names pop-ups on tiki.org and doc.tiki.org while it works just fine on dev.tiki.org and shows correctly Last login ...bla bla... for them?

Mystery to me :-o

Some difference in the site setup?

luci

If I have a login box module, and I visit tiki-login_scr.php, I get two places to login

Same thing with error pages which offer to login.

If your users login has a ".", as in "firstname.lastname", the remember me feature breaks.

This is the snippets in tiki-login.php use to set the cookie:

{img src=images/code.png}%%% {CODE()}
// Now if the remember me feature is on and the user checked the rememberme checkbox then ...
if ($rememberme != 'disabled') {
if (isset($_REQUEST['rme']) && $_REQUEST['rme'] == 'on') {
$hash = $userlib->get_user_hash($_REQUEST['user']);
$hash = $userlib->create_user_cookie($_REQUEST['user']);
$time = substr($hash,strpos($hash,'.')+1);
setcookie($user_cookie_site, $hash.'.'.$user, $time, $cookie_path, $cookie_domain);
$logslib->add_log('login',"got a cookie for $remembertime seconds");
}
}
{CODE}


The cookie content has the following format:
{img src=images/code.png}%%% {CODE()}
md5($_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT']).(date('U') + $remembertime).$user
{CODE}

The following code in userslib.php parse the cookie content. This function will successfully returns
the user only if your users login does not have a ".", otherwise this function will always return
false, and users have to re-login everytime.

{img src=images/code.png}%%% {CODE()}
function get_user_by_cookie($hash) {
list($check,$expire,$userCookie) = explode('.',$hash);
if ($check == md5($_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT'])) {
$query = 'select `user` from `tiki_user_preferences` where `prefName`=? and `value`=? and `user`=?';
$user = $this->getOne($query, array('cookie',"$check.$expire", $userCookie));
if ($user) {
if ($expire < date('U')) {
$query = 'delete from `tiki_user_preferences` where `prefName`=? and `value`=?';
$user = $this->query($query, array('cookie',$hash));
return false;
} else {
return $user;
}
}
}
return false;
}

{CODE}

Sometimes, I want to restrict who uses Tiki's internal search engine. Maybe I have some non-linked pages, that people can discover via the search engine.

In Admin -> Login check both:
- Users can register:
- ... but need admin validation:

Admin validation isn't required, new users still can register and login immediately.

We receive many issues while people try to register. So I went to test out what is going on... While testing new user registration in new incognito mode Chrome I got this when I submitted the filled in form:
{img fileId="1361" thumb="box"}

Not a good feedback to the user trying to register :(

Steps to reproduce:

# open new incognito window
# go to https://tiki.org/login
# click the Register link in the login form which brings you to https://tiki.org/tiki-register.php?key=randomstring
# fill in the form and click "Register" button
# you get the error screen

__Anyway, the user was created.__
As an admin I received immediately a watch notification email first:
^__User joined Registered__
The user lucitest joined Registered%%%
at: Sun 23 Feb 2020 17:13 CET^

Then --after some minutes (17:21 CET)-- 17:14 CET I received "Community Members Information" tracker email about the Item Creation too __with no link to validate the user__ (but at that time I validated the test user manually already).

We also receive many registration attempts (in comparison as seen while watching user joining Registered group) __without__ any tracker or validation link emails coming out / being received at all.
---
Confirmed sadly {sign user="jonnybradley" datetime="2020-03-09T17:22:33+00:00"}

We were trying to have the new antibot captcha working in a Tiki site based on Tiki trunk (during TikiFestBarcelona2 - mid July 2010), were a user tracker was set to collect more information from users at registration time.

when we enabled zend new antibot-captcha , no antibot code was shown at registration time, because there seems to be some conflict with the user tracker.
Once the user tracker was disabled, the antibot-captcha was shown properly, etc.

----
Update: disaled the new zend antibot catpcha, in order to use the former simple captchaimage, but that one is not working either, if user tracker is on.

One can ask for the realName "admin" and get it with no problem. In fact, all the 1000 users of a site could be called admin.
TW51

On a fresh Tiki19 rev 68300 (after installing the profile "groupmail") I fill the field to register a new user and click on the register button.

Page is refreshed (data still in the fields) but I’m not redirected to the success page. The user is created.

When I check the "Log In" control panel it seems :
__User tracker IDs to sync prefs from__
and
__Tracker field IDs to sync the "real name" pref from__
don’t contain the right information (blank).
Same for the information needed in the registered group.

I corrected in my demo but the profile must be corrected.
Not sure how.

In earlier Tiki versions, the CAPTCHA for the registration was separate from other anti-bot protection. It was possible to have CAPTCHA protection for some areas (such as comments and trackers) but not other areas (such as registration).

I have several sites that use "Require Admin Approval" and/or passcode options for Registration, so the CAPTCHA is not needed.

In Tiki 6, CAPTCHA was made global -- there is no longer any way to have CAPTCHA support for some items, such as comments, but not other items (such as registration).

When a new user is created through the "register" feature, they are redirected to the same registration page upon success, with no message saying "success" of any kind.

I would recommend that after they have registered, they will not likely want to register a second account, so landing on the same page is not optimal. I would also expect to see something that says the user is created, and perhaps say if an email needs to be confirmed or not.

Whilst debugging a SAML setup I get the following.

===Notice: Undefined variable: username in /var/www/html/lib/userslib.php on line 786===

I appreciate that my SAML config might be wrong at this point, but this is a software bug.

Thanks

Rob

On a new 1.10 installation...

When logging in as the ADMIN for the first time, the Change Password Enforced page appears (requiring new admins to select a new password). The OLD PASSWORD field should be maintained (pre-filled) with the existing admins password (by default: ADMIN). This __used__ to be the case in 1.9.

Pre-populate the OLD PASSWORD field with the user's existing password. This field should be disabled, so the user cannot change it.

There is a very common use case where a specific Group should be given User admin permission, ie tiki_p_admin_users, so that the setting up of new users can be delegated.

However this permission allows the user with these added permissions to edit the admin details and therefore be in a position to assign new users and themselves to the Admins Group - which has 'security' (in the broadest sense) implications.

Changes that avoid this are needed so that the admin details can only be changed by the admin.

FIXED

I activated the Tiki + OpenID login, and pasted the google OpenId url: https://www.google.com/accounts/o8/id

The result is a blank page. I tested by turning off the server firewall completely to make sure there was no issue with the port.

I want to test it here on the show-me instance to confirm the issue.

When using OpenID + Registration CAPTCHA...
With Tiki 2.2...

I attempted to register using my OpenID:

#On the Login page, I entered my OpenID.
#My OpenID was validated and Tiki shows the page where I can either associate my OpenID with an existing Tiki account, or register as a new user.
#I completed the registration form (including the correct CAPTCHA), but Tiki keeps saying that the Anti-bot code was incorrect.

Additionally, the registration form presented with the OpenID __does not__:
*Display the password minimum requirements (such as number of characters).
*Allow for the selection of groups.


__Duplicate of {wish id=1505}__

For sites with open content it's very important that a visitor who came through a link from search engine or somewhere else would have minimum problems with adding new information to the wiki.
My personal example: I have a blog on livejournal.com and now plan to create a homepage based on tiki, but I don't want to make all of my friends from LJ to pass registration on my site. Even if they all would, it's unreal to make them all use the same logins as there.

Active Directory doesn't allow for anonymous searches of its structure. Instead, an username and password for an account with search access must be given when connecting.

I have encountered a few snags after upgrading from Tiki 1.9.11 to 2.0

One of the problems is that I am unable to register / add users, because of the following error message:

An error occured in a database query!
Unknown column 'email_confirm' in 'field list'

This happens on
tiki-register.php (registration) and tiki-adminusers.php (batch upload / add)

Is there a fix for this?