Category: User Administration (Registration, Login & Banning)

I have configured "tiki and pear::auth" in the login section of tikiwiki on a server which did not have the pear php libraries installed.
Next time I try to login with a user (not admin), I see a blank page.

This happens because on line 756 of file lib/userslib.php
$a = new Auth("LDAP", $options, "", false, $user, $pass);
just dies without any error message.

Using 1.10 cvs from mid june 2007 (but I bet that this issue might exist also in 1.9.x)

I wonder whether this is going to be considered as a bug or a RFE by coders... (but I consider it a usability bug).

We need a way to ensure that users accept some conditions at registration time to our tiki site. (to conform our laws of privacy of users information kept by the organization, etc.)
We have just set a new tracker item field of type "checkbox", and set it as <span style="color:black;background-color:#ffff66;">mandatory</span>.
But I (as admin) have been able to edit items without checking that checkbox, without any warning that this field is missing, etc. And I could save the edition without that checkbox. But I did get those messages (as expected) when attempting to leave empty any of the other <span style="color:black;background-color:#ffff66;">mandatory</span> fields...

If not using this checkbox approach, there should be a way to configure such a tracker with a required checkbox or similar to be checked.
---
Update using 1.10svn from end of May'08: this bug is still around...

I just did a test of the Registration tracker at:
http://tikiwiki.org/tiki-register.php

One of the checkboxes was mandatory. Since it's to accept something, it's not clear that I am not required to check it.

A drop-down would have been better in this case.

{syntax type="tiki" editor="plain"}
So when I see that someone reported a bug, I can quickly see their profile. (ex.: to send a private message)

I wonder if this issue is just happening in show.t.o and why.
But in any case, it's preventing to report any bugs in trunk (16.x), so I hope someone can have a look at this issue.

trunk (16.x) in show.t.o: I can't do the first login as admin admin

Reproduced here:
http://xavi-9794-6009.show.tikiwiki.org/

I can't login to the new trunk show.t.o instance just created, neither with Chrome nor Firefox, with the usual credentials for the first connection:
u: admin
p: admin

I get __invalid username__ with this url produced in the first attempt to connect:
http://localhost/trunk/tiki-change_password.php?user=admin&oldpass=admin&newuser=y

or with this other one:
http://localhost/trunk/tiki-login.php
I get:
__Error__
__Invalid username or password__

---
Update:
I checked today table users_users and I confirm that there is no user admin created at all. {sign user="xavi" datetime="2016-07-07T12:26:00+00:00"}

{syntax type="tiki" editor="plain"}
On a Tiki27 I enable two-factor authenticator.
If I go to "tiki-login_scr.php?twoFactorForm" and try to log it work just fine.

If I try to log from "login" or "tiki-login_scr.php" and try to log from the displayed screen (without filling a two-factor authenticator pin) I got a 500 error.

{file type="gallery" fileId="3074" showicon="y"}

This case should be handled more properly and in an user-friendly way.

Example:
You should be redirected to the proper login page "tiki-login_scr.php?twoFactorForm" with a remarksbox saying you need to enter a two-factor authenticator pin.

This is quite important for the feature as then can be many place that redirect you to the login page in Tiki.
Also, not all admins will think to redirect from the admin login preferences the login page to ""tiki-login_scr.php?twoFactorForm".

In {gitlab id=06432228} 2FA arrived in Tiki for ((doc:Tiki21)) but there are a couple of improvements that would be nice to have for 21.0 (:mrgreen:)

* When i enabled it on [https://example.com/tiki-user_preferences.php#contentmytiki_user_preference-3|my user preferences] and then revealed the QR code (which i think it should show automatically) there's no input to enter a code to confirm it's working, which most sites using 2FA let you do.
*-- Then when i logged out and then went to log back in, i think that login form should have the 2FA input on it, rather than link to a new form (please)-- There is a param on the login box module called show_two_factor_auth - set it to "y" to enable, thanks!
* Also a question: Is it compatible with ((doc:InterTiki))? If so i'll enable it on [https://tiki.org] for extra dogfood! ?

Mainly thanks!

When trying to reset a password for a user you can't click the confirm button on the confirm page. Click the confirm to submit the form gives the javascript error "uncaught TypeError: Property 'submit' of object #<an HTMLFormElement> is not a function" in chrome. This is caused by one of the inputs in the form being named submit. So the function the confirm button calls "javascript:document.forms['confirm'].submit();" is calling the submit input element instead of the submit method of the form. To fix this change the name of the submit button in tiki-adminusers.tpl from "submit" to something else.

Yahoo! now provides OpenID support for all Yahoo! IDs. However, I am unable to login to any Tiki by using my Yahoo! OpenID.

See http://tikiwiki.org/tiki-view_forum_thread.php?forumId=4&comments_parentId=28775

While translating, I came across a feature that has text, description and help - but it seems to be without function?

Prevent common passwords.

"Prevent common passwords":
"For improved security, prevent passwords in your password blacklist from being used."

If you check the checkbox - nothing happens. I would have expected that some sort of blacklist would have to be entered? Or does it work differently?

Thanks
hman

The user ban system has a help text that suggests a feature, that seemingly does not (not yet?) exist: Exporting rules... [see comment. this has cleared up. I leave this text only as an explanation why I originally opened this as a feature request]

"section names are splitted by pipes (vertical bars). To see an example and use it as template, add one rule by hand, and export it as csv"

There is an import feature, but no export feature... Could also be handy for admins who want to extend bans to more than one Tiki, if they arent connected by InterTiki (dunno whether InterTiki cares about bans at all).

I tried whether the export feature would only come up once at least one rule exists, but no, no export. Existing rule can be edited or deleted, not exported.

Thanks
hman

On a fresh install at Admin -> Log in I enable "Users can register", I uncheck "Validate new user registrations by email" and I set an URL for the field:"URL the user is redirected to after account validation"

So validation is not done using the email link but is done right away after validating the register form.

I create a wiki page: mysuccesspage and tried with page name, a relative path tiki-index.pgp?page= mysuccesspage and an absolute path: http://mysite.com/tiki-index.pgp?page= mysuccesspage

I’m redirected to the default registration page.

I enabled back "Validate new user registrations by email"to check and it worked.

----

I created an instance to demonstrate:
Setting are good : http://bsfez-11581-6095.show.tikiwiki.org/tiki-admin.php?page=login
Success page exist : http://bsfez-11581-6095.show.tikiwiki.org/tiki-index.php?page=success

{img src=images/code.png}%%% {CODE(wrap=1)}
(6:51:03 PM) The topic for #sumo is: irc channel for development of http://support.mozilla.com/ || see also mozilla.support.planning (newsgroup) || Next meeting: 2pm PST Dec. 4; http://wiki.mozilla.org/Support/Weekly_Meetings || If you'd like to help test the live chat software PM Lucy
(7:19:06 AM) MarcoZ: Hi there!
(7:19:29 AM) Tomcat: hi MarcoZ :)
(7:19:53 AM) MarcoZ: Hi Tomcat!
(7:20:23 AM) MarcoZ: Can anybody tell the new kid on the blog how to create an article on Sumo? I would like to get an article into the knowledgebase about what's new in the area of a11y in Firefox 3.
(7:20:36 AM) MarcoZ: But I can't find a way (at least none that is obvious to me) how to start an article.
(7:20:55 AM) Tomcat: Lucy: ^
(7:21:20 AM) Tomcat: in case you are awake :)
(7:57:08 AM) marclaporte: MarcoZH: I don't know what the editorial rules are, but just edit a page and change the name in the URL
(8:07:42 AM) MarcoZ: marclaporte, thanks, will give this a try. If I simply do something like support.mozilla.com/kb/MyNewTitle , I get a 404, and an option to create a new page, but with the hint in parentheses that "this page will be orphaned", but without any further explanation to what this implies.
(8:08:18 AM) MarcoZ: djst, hi! This is Marco, the a11y guy :-)
(8:09:44 AM) djst: MarcoZ: hey thre!
(8:10:00 AM) djst: MarcoZ: great to see you around
(8:11:02 AM) djst: MarcoZ: i missed your previous conversation with marclaporte, in case there's anything you're wondering about
(8:11:13 AM) djst: MarcoZ: is the sumo site usable at all as it is?
(8:12:22 AM) MarcoZ: djst, yes it is usable and has good markup. That's not a problem. I just can't figure out how to start a new article. I shot you an e-mail about it earlier, but if you know the answer from the top of your head, we can discuss it here.
(8:13:00 AM) djst: ah yeah, let me see if there's a fix for that. there was a quick edit form in the contributor home page before but i think it was removed
(8:13:02 AM) djst: let me check
(8:14:08 AM) djst: MarcoZ: http://support.mozilla.com/kb/Creating+articles
(8:14:27 AM) djst: that page is linked to from the contributor home page (which should be the page you see when you log in, but currently it's not)
(8:14:43 AM) djst: MarcoZ: this is not optimal, we should make this easier to see
(8:19:38 AM) MarcoZ: djst, thanks this is the starting point I needed.
(8:20:05 AM) djst: MarcoZ: ok. i'm here most of my work days so just ping me if you need any other info.
(8:21:24 AM) marclaporte: :-)
(8:22:04 AM) marclaporte: MarcoZ: are you using JAWS or something similar?
(8:31:45 AM) MarcoZ: marclaporte, yes, on Windows I'm using JAWS, on Linux I'm using Orca.
(8:33:40 AM) marclaporte: MarcoZ: I have a few questions about a11y and wikis if you don't mind
(8:34:53 AM) marclaporte: 1st off: an intro so you get an idea where I am coming from. My name is Marc Laporte and I am a project admin for TikiWiki CMS/Groupware
(8:35:25 AM) marclaporte: I took a course on a11y, but I never really had much real world experience
(8:36:12 AM) marclaporte: I would like TikiWiki to become more & more accessible, hopefully, eventually, fully accessible out of the box
(8:36:49 AM) marclaporte: I have a theory that wiki syntax maybe a positive thing for a11y, but I don't know really
(8:37:30 AM) marclaporte: (compared to standard html CMSs or the ones that use WYSIWYG/rich text editors)
(8:38:32 AM) marclaporte: We currently have no one helping/promoting/testing/etc a11y and I hope this could change.
(8:38:49 AM) marclaporte: so....
(8:39:08 AM) MarcoZ: marclaporte, thanks for your introduction! I started as the accessibility QA at Mozilla last week.
(8:39:28 AM) marclaporte: sweet
(8:41:07 AM) marclaporte: So what is global a11y status in FF as of now?
(8:41:24 AM) MarcoZ: marclaporte, so far what I've seen looks pretty good with JAWS on Sumo. The only real problem I ran into was actually signing up. The captcha system is not accessible at all. There is an accessible chaptcha system called ReCaptcha (http://www.recaptcha.net) that is accessible. That's the one improvement I definitely know Tiki could use. Unless of course, the captcha isn't standard, .
(8:42:01 AM) marclaporte: MarcoZ: I appreciate the feedback
(8:42:04 AM) MarcoZ: well, global a11y status in FF 3 will be a lot better than in 2, primarily because FF3 is also going to be accessible on Linux, not just Windows.
(8:42:18 AM) marclaporte: I see
(8:42:38 AM) marclaporte: Is wiki syntax better or worse for a11y?
(8:42:47 AM) marclaporte: (in general, not specifically TikiWiki)
(8:43:01 AM) MarcoZ: I made the switch from IE quite a long time ago, and there's only one site that I can't use with Firefox. And that's not because of a11y reasons, but because the music store I use here in Germany only works with IE, so every sighted person will also have this problem. :-)
(8:43:28 AM) MarcoZ: I mostly worked on MediaWiki so far, and the Wiki syntax was easy to grasp for me.
(8:43:59 AM) MarcoZ: It is appreciated to have these helper buttons/links available to insert the Wiki tags, so one doesn't have to memorize them all, but editing stuff, and having a feeling I know what I'm doing, is good with Wiki syntax.
(8:46:29 AM) marclaporte: MarcoZ: are you able to use the quicktags? or you type the syntax?
(8:51:33 AM) marclaporte: MarcoZ: I am going to log a feature enhancement request on dev.tikiwiki.org wishlist. May I copy/paste our current discussion in the tracker?
(8:51:33 AM) MarcoZ: The quicktags appear as links for JAWS, so i can simply select one and activate it to insert the quicktags. Works quite nocely actually. :-)
(8:52:26 AM) MarcoZ: marclaporte, sure!
(8:52:59 AM) marclaporte: MarcoZ: so you insert and after you find the text with wiki syntax and you go and change it?
(8:58:04 AM) MarcoZ: marclaporte, yes. For example, the heading level 1 notation is an exclamation mark followed by text, heading level 2 is two exclamation marks. I simply change the text after it.
(8:59:49 AM) marclaporte: Excellent.
(9:00:12 AM) marclaporte: ReCaptcha is very interesting!
{CODE}

This is a useful feature for an Intranet. However it's not so good if the emails are not to be disclosed. I think some code has been done in 1.10 for this. However, the feature probably needs more work.

{syntax type="tiki" editor="plain"}
Problem: users forget their username

But they should remember their email.

Maybe this feature request is not trivial because password is encrypted with username.

But maybe it could be:

user enters email.
Tiki checks what is the username for that email

login is attempted with the username and password



Ideally, system would accept either email or login in interface (case insensitive)

I have problems with login/user banning, because of spam-users.
The users have already the same email-address or a part is identical.

I have a dream, banning a user per part of an email address....

User selects group at registration and the respective tracker fields show. Fine so far. However if data entered by user in one of the group tracker fields fail validation, the user is nevertheless created. The newly created user is not assigned the group for which he opted and the group tracker is not appended.

Ideal behaviour should be that the user is not created if validation fails.

So we know which admin created a login...


We currently have a log entry when a user is assigned to a group, but not when he is unassigned.

Also, we have:
unassigned perm tiki_p_broadcast from group admin

but not:
assigned perm tiki_p_broadcast from group admin



Maybe adding failed login attempts would be good too...

{syntax type="tiki" editor="plain"}
When the feature "use email as username" is turned on, the user creation in the backend fails if "send email to user for validiation" is turned on.

To reproduce this, enable "use email as username" and try to create a new user in the admin-users menu. If "Send an email to the user in order to allow him to validate his account" is checked, the creation fails with a message "email validiation requested but email address not set".

The reason for this is that the html form does not contain an email field (since the email is used as username).

This is a site which is not available to the public. Therefore, if someone follows a link to a resource, they are redirected to the login page and after logging in, they get redirected to the resource they wanted to watch.

This works for resources such as web pages of calendar events (good!) but __not__ for tracker item resources (bug!).

!! Config of show instance
The configuration is close to the default.
!!!Changes are
^Global permissions:
Added
Registered: tiki_p_view (wiki)
Registered: tiki_p_view_trackers (trackers)
Registered: tiki_p_view_calendar (calendar)
Registered: tiki_p_view_events (calendar)
Deleted
Anonymous and all the children groups: tiki_p_view (wiki)
^
In [http://jyhem-9952-7592.show2.tikiwiki.org/tiki-admin.php?page=general]
^ The following change has been applied
Preference permission denied url set (Preference name: permission_denied_url)
^
!!! How to reproduce
Now you can try loging out and accessing the following:
* Direct link towards a tracker item (__fails to direct to the item after logging__) : [http://jyhem-9952-7592.show2.tikiwiki.org/tiki-view_tracker_item.php?itemId=1]
* Direct link towards a wiki page (works fine: on sees the file right after logging) : [http://jyhem-9952-7592.show2.tikiwiki.org/tiki-index.php?page=Not-home-page]
* Direct link towards a calendar item ((works fine: on sees the file right after logging) : [http://jyhem-9952-7592.show2.tikiwiki.org/tiki-calendar_edit_item.php?viewcalitemId=1]

Why does it not work for tracker item resources?

I could not find any obvious reason :-(

You can set a tracker to hold more user information.
On the tiki preferences (tiki-user_preferences.php) it will set a link "User's personal tracker information: View extra information".

With tiki in english the link will go to the user (latin-char or non-latin-char) i'm look at.
If the Tiki is set to multilingual the link is broken and will show my own (admin for example) information.

admin home/community/user preference screen is on

* Created a user tracker with a user preference field, "realName", which is asked from the user at registration time. One can fill in at registration an edit box for the field, but the field is not updated. Neither is the realName user preference set (if looking at the user preference screen).

* If the realName user preference is set on the user preference screen, it does show up in the tracker.

* The view_tracker_item / edit tab does not show an edit box. (another bug perhaps)

unknown
* if it worked for email user pref.

known
* a standalone tracker plugin does work either, while the item's last modification date changes (used for an existing tracker item, offering a single input field to change the real name)
* wikiplugin_tracker.php does not contain any 'p', which would refer to the user preference type

Workflow.tikiwiki.org is running 1.9.8.3. I was playing around with InterTiki settings and enabled pulling of UserPrefs from the master site. I know on the mater site, my particular user ID has privacy turned on such that my information is not visible to users.

When I go to wf.tw.o as an anonymous user, I can hover my cursor over a user (such as myself) and it will show a box with my information...email address, location, etc. When I try and do the same on the tw.o master site, I get "user information is private" or something.

I'm wondering if there is a bug or oversight with InterTiki where it is not pulling all of the user preferences, and if that is the case, if someone can fix it so that privacy settings are honoured?

Thanks!

Not sure if this is prevalent in 1.10.0 or not, but...

User twentytwo had problems in IRC with user registration set to ON with validation set ON. When the regisration form was submitted by the new user, the script would bomb with an SQL error because the first three fields were nulls and couldn't be.

I could only reproduce this bug when User Registration was turned on, with validation also turned on, but with General->Sender email UNSET. So during setup, the sender email was not set. As I also do not have this set at home since I don't want to send any emails, I was able to reproduce the problem. With sender email SET, there is no DB error.

I have encountered a few snags after upgrading from Tiki 1.9.11 to 2.0

One of the problems is that I am unable to register / add users, because of the following error message:

An error occured in a database query!
Unknown column 'email_confirm' in 'field list'

This happens on
tiki-register.php (registration) and tiki-adminusers.php (batch upload / add)

Is there a fix for this?