Anonymous Registration to VoxForge website not working

[kmaclean]

There are two types of anonymous registration using WebGUI:

• using email validation
• using captcha

anonymous registration using email validation is still broken in 7.5.24. It is fixed in the 7.6.0-beta series - see ​WebGUI bug report. We'll wait until this goes stable for a few releases before upgrading...

As a workaround to allow anonymous registration, we will now use captcha using a ​patch.

[kmaclean]

this ​post says:

If you’ve ever worked on a server that was being overworked (I know I have), you might see sendmail throw out a message like this one:

Jan 9 14:15:49 mail sendmail[18184]: rejecting connections on daemon MTA: load average: 70

This is sendmail’s way of trying not to contribute to the already high load placed on the server. Since busy mail servers generally use a lot of disk I/O for the queue, and they may pass mail to other filters (which uses CPU time), the sendmail daemon will refuse to handle mail to help reduce the load.

If you don’t like the values that are currently set, you can change them with the following configuration directives in your sendmail.mc:

define(`confQueueLA', `100')dnl
define(`confRefuseLA', `100')dnl

The confQueueLA defaults to the number of processors in your system multiplied by eight, and the confRefuseLA defaults to the number of processors in your system multiplied by 12. However, it is noted that this default differs between versions as well as distributions.

The two configuration items control when sendmail will process items in the queue only (QueueLA) and when sendmail will stop accepting incoming SMTP connections all together (RefuseLA).

[kmaclean]

WebGUI ​bug report

The "Validate email addresses" in Admin Console -> Settings -> Authentication does not appear to work if checked to yes. If someone tries to register, they receive the email , but clicking on the link only sends them to the login page, but does not establish the user account.

I also tried this on the demo at webgui to check it and received the email same as mine:

Subject: Account Activation Welcome to our site. Please click on the link below to activate your account.

​http://beta.webgui.org/demo1221594155_386/home?op=auth;method=validateEmail; key=7CLaKBRzhooHmoirQOTqOQ

The link just takes me to the login page, but the account is not established. Trying to login as the registered user gives :

Error:

The account information you supplied is invalid. Either the....

By the way, I had also checked other fields as required and show at registration under Admin Console -> User Profiling I don't think this should matter.

Thank you.

[kmaclean]

These errors are likely a red herring:

Get this error in the webgui.log

2008/09/17 06:02:15 - ERROR - www.voxforge.org.conf - WebGUI::Auth::WebGUI::emailRecoverPassword[755] - <h1>Password Recovery </h1> <h3>Enter either your email address or your login below to initiate the password recovery process.</h3>

<form action="/home/docs/faq/faq/what-is-gpl" enctype="multipart/form-data" method="post" ><div class="formContents">
<table  style="width: 100%;"><tbody><tr style="display: none"><td></td><td><input type="hidden" name="op" value="auth"  />
</td></tr><tr style="display: none"><td></td><td><input type="hidden" name="method" value="recoverPasswordFinish"  />
</td></tr><tr id="username_formId_row">
				<td class="formDescription"  valign="top" style="width: 180px;"><label for="username_formId">Login Name</label><div class="wg-hoverhelp">Enter your username here</div></td>
				<td valign="top" class="tableData" ><input id="username_formId" type="text" name="username" value="" size="40" maxlength="255"  /></td>
			</tr>
<tr id="email_formId_row">
				<td class="formDescription"  valign="top" style="width: 180px;"><label for="email_formId">Email Address</label><div class="wg-hoverhelp">Enter your email address here</div></td>
				<td valign="top" class="tableData" ><input id="email_formId" type="text" name="email" value="" size="40" maxlength="255"  onchange="emailCheck(this.value)"  /></td>
			</tr>
<tr id="_formId_row">
				<td class="formDescription"  valign="top" style="width: 180px;"><label for="_formId"></label></td>
				<td valign="top" class="tableData" ><input type="submit" value="save" class="forwardButton" /></td>
			</tr>
</tbody></table>
</div></form>

Sendmail log says:

Sep 17 06:15:21 ruby sendmail[31268]: m8HAF67q031268: from=root, size=344, class=0, nrcpts=1, msgid=<200809171015.m8HAF67q031268@ruby.localdomain>, relay=root@localhost
Sep 17 06:15:23 ruby sendmail[2366]: rejecting connections on daemon MTA: load average: 12
Sep 17 06:15:38 ruby sendmail[2366]: rejecting connections on daemon MTA: load average: 12
Sep 17 06:15:45 ruby sendmail[31268]: m8HAF67q031268: to=root, ctladdr=root (0/0), delay=00:00:39, xdelay=00:00:00, mailer=relay, pri=30344, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0, stat=Deferred: Connection refused by [127.0.0.1]
Sep 17 06:15:53 ruby sendmail[2366]: rejecting connections on daemon MTA: load average: 13
Sep 17 06:16:23 ruby last message repeated 2 times
Sep 17 06:16:38 ruby sendmail[2366]: rejecting connections on daemon MTA: load average: 12
Sep 17 06:16:53 ruby sendmail[2366]: accepting connections again for daemon MTA
Sep 17 06:21:23 ruby sendmail[2366]: rejecting connections on daemon MTA: load average: 12
Sep 17 06:21:38 ruby sendmail[2366]: accepting connections again for daemon MTA
Sep 17 06:28:12 ruby sendmail[31407]: NOQUEUE: connect from ruby.localdomain [127.0.0.1]
Sep 17 06:28:13 ruby sendmail[31407]: AUTH: available mech=DIGEST-MD5 CRAM-MD5 GSSAPI NTLM, allowed mech=EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN
Sep 17 06:28:13 ruby sendmail[31407]: m8HASC6f031407: Milter: no active filter
Sep 17 06:28:14 ruby sendmail[31407]: STARTTLS=server, relay=ruby.localdomain [127.0.0.1], version=TLSv1/SSLv3, verify=NO, cipher=DHE-RSA-AES256-SHA, bits=256/256
Sep 17 06:28:14 ruby sm-msp-queue[31406]: STARTTLS=client, relay=[127.0.0.1], version=TLSv1/SSLv3, verify=FAIL, cipher=DHE-RSA-AES256-SHA, bits=256/256
Sep 17 06:28:14 ruby sendmail[31407]: STARTTLS=server, cert-subject=, cert-issuer=, verifymsg=ok
Sep 17 06:28:14 ruby sendmail[31407]: AUTH: available mech=LOGIN DIGEST-MD5 PLAIN CRAM-MD5 GSSAPI NTLM, allowed mech=EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN
Sep 17 06:28:14 ruby sendmail[31407]: ruleset=trust_auth, arg1=root@ruby.localdomain, relay=ruby.localdomain [127.0.0.1], reject=550 5.7.1 <root@ruby.localdomain>... not authenticated
Sep 17 06:28:28 ruby sendmail[2366]: rejecting connections on daemon MTA: load average: 12
Sep 17 06:28:36 ruby sendmail[31407]: m8HASC6g031407: from=<root@ruby.localdomain>, size=603, class=0, nrcpts=1, msgid=<200809171015.m8HAF67q031268@ruby.localdomain>, proto=ESMTP, daemon=MTA, relay=ruby.localdomain [127.0.0.1]
Sep 17 06:28:43 ruby sendmail[2366]: rejecting connections on daemon MTA: load average: 12
Sep 17 06:28:58 ruby sendmail[2366]: rejecting connections on daemon MTA: load average: 13
Sep 17 06:28:58 ruby sm-msp-queue[31406]: m8HAF67q031268: to=root, ctladdr=root (0/0), delay=00:13:52, xdelay=00:00:46, mailer=relay, pri=120344, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (m8HASC6g031407 Message accepted for delivery)
Sep 17 06:29:13 ruby sendmail[2366]: rejecting connections on daemon MTA: load average: 14
Sep 17 06:29:28 ruby sendmail[2366]: rejecting connections on daemon MTA: load average: 14
Sep 17 06:29:38 ruby sendmail[31414]: m8HASC6g031407: to=<root@ruby.localdomain>, ctladdr=<root@ruby.localdomain> (0/0), delay=00:01:23, xdelay=00:00:06, mailer=local, pri=30881, dsn=2.0.0, stat=Sent
Sep 17 06:29:40 ruby sendmail[31414]: m8HASC6g031407: done; delay=00:01:25, ntries=1
Sep 17 06:29:47 ruby sendmail[2366]: rejecting connections on daemon MTA: load average: 12
Sep 17 06:30:02 ruby sendmail[2366]: rejecting connections on daemon MTA: load average: 12
Sep 17 06:30:17 ruby sendmail[2366]: rejecting connections on daemon MTA: load average: 12
Sep 17 06:30:32 ruby sendmail[2366]: rejecting connections on daemon MTA: load average: 13
Sep 17 06:30:47 ruby sendmail[2366]: rejecting connections on daemon MTA: load average: 12
Sep 17 06:31:02 ruby sendmail[2366]: accepting connections again for daemon MTA

[kmaclean]

see WebGUI::Auth::WebGUI

from WebGUI site: Revision 7706 - fixed: anonymous registration with email confirmation is broken

[kmaclean]

see WebGUI::Auth::WebGUI

from WebGUI site: ​Revision 7706 - fixed: anonymous registration with email confirmation is broken

[kmaclean]

Here is a suggested patch to the createAccountSave method (using some borrowed code from the 7.6.0 release...):

sub createAccountSave {

    ...

    # Create the new account
    my $properties;
    $properties->{ changeUsername       } = $setting->get("webguiChangeUsername");
    $properties->{ changePassword       } = $setting->get("webguiChangePassword");  
    $properties->{ identifier           } = Digest::MD5::md5_base64($password);
    $properties->{ passwordLastUpdated  } = $session->datetime->time();
    $properties->{ passwordTimeout      } = $setting->get("webguiPasswordTimeout");
# !!!!!!   
    #$properties->{ status } = 'Deactivated' if ($setting->get("webguiValidateEmail"));
    my $afterCreateMessage = $self->SUPER::createAccountSave($username,$properties,$password,$profile);
# !!!!!!
    # Send validation e-mail if required
    if ($setting->get("webguiValidateEmail")) {

        ...

        $self->user->status("Deactivated");

        ...

    }
# !!!!!!!
    else {
        $self->user->status("Active");
    }
    #return $self->SUPER::createAccountSave($username,$properties,$password,$profile);
    return $afterCreateMessage;
# !!!!!!!   
}

The set status to "Active" might need to be made conditional on "($setting->get("webguiUseCaptcha"))", but that seems to be covered higher up in the method (in the validate input section).

[kmaclean]

Actual code in prod:

sub createAccountSave {
    my $self        = shift;
    my $session     = $self->session;
    my $form        = $self->session->form;
    my $setting     = $self->session->setting;
    my $i18n        = WebGUI::International->new($session);

    # Logged in users cannot see this page
    return $self->displayAccount if ($session->user->userId ne "1");

    # Make sure anonymous registration is enabled 
    if (!$setting->get("anonymousRegistration") && !$setting->get("userInvitationsEnabled")) {    
        $session->errorHandler->security($i18n->get("no registration hack", "AuthWebGUI"));
        return $self->displayLogin;
    }
    my $username    = $form->process('authWebGUI.username');
    my $password    = $form->process('authWebGUI.identifier');
    my $passConfirm = $form->process('authWebGUI.identifierConfirm');
   
    # Validate input
    my $error;
    $error = $self->error unless($self->validUsername($username));
        if ($setting->get("webguiUseCaptcha")) {
            unless ($form->process('authWebGUI.captcha', "Captcha")) {
                $error .= '<li>'.$i18n->get("captcha failure","AuthWebGUI").'</li>';
            }
        }
    $error .= $self->error unless($self->_isValidPassword($password,$passConfirm));
    my ($profile, $temp, $warning) = WebGUI::Operation::Profile::validateProfileData($self->session, {regOnly => 1});
    $error .= $temp;
     
    return $self->createAccount($error) unless ($error eq "");

    # If Email address is not unique, a warning is displayed
    if ($warning ne "" && !$self->session->form->process("confirm")) {
        return $self->createAccount('<li>'.$i18n->get(1078).'</li>', 1);
    }

    # Create the new account
    my $properties;
    $properties->{ changeUsername       } = $setting->get("webguiChangeUsername");
    $properties->{ changePassword       } = $setting->get("webguiChangePassword");   
    $properties->{ identifier           } = Digest::MD5::md5_base64($password);
    $properties->{ passwordLastUpdated  } = $session->datetime->time();
    $properties->{ passwordTimeout      } = $setting->get("webguiPasswordTimeout");
# !!!!!!    
    #$properties->{ status } = 'Deactivated' if ($setting->get("webguiValidateEmail"));
    my $afterCreateMessage = $self->SUPER::createAccountSave($username,$properties,$password,$profile);
# !!!!!!
    # Send validation e-mail if required
    if ($setting->get("webguiValidateEmail")) {
        my $key = $session->id->generate();
        $self->saveParams($self->userId,"WebGUI",{emailValidationKey=>$key});
        my $mail = WebGUI::Mail::Send->create($self->session,{
            to      => $profile->{email},
            subject => $i18n->get('email address validation email subject','AuthWebGUI')
            });
        $mail->addText(
            $i18n->get('email address validation email body','AuthWebGUI') . "\n\n"
            . $session->url->getSiteURL() 
            . $session->url->page("op=auth;method=validateEmail;key=".$key) . "\n\n"
        );
        $mail->addFooter;
        $mail->send;
        $self->user->status("Deactivated");
        $session->var->end($session->var->get("sessionId"));
        $session->var->start(1,$session->getId);
        my $u = WebGUI::User->new($session,1);
        $self->{user} = $u;
        $self->logout;
        return $self->displayLogin($i18n->get('check email for validation','AuthWebGUI'));
    }
# !!!!!!!
	elsif ($setting->get("webguiUseCaptcha")) {
		$self->user->status("Active");
	}
    #return $self->SUPER::createAccountSave($username,$properties,$password,$profile);
    return $afterCreateMessage;
# !!!!!!!    
}

[kmaclean]

It turns out that this was not a problem with the code, but a problem with the database table defaults.

The upgrade_7.5.10-7.5.11.pl script contains a sub that was commented out called: #ensureCorrectDefaults( $session );

Put the contents of this sub into a file and ran against the www_voxforge_org MySQL table as follows:

mysql -u user -p < /home/kmaclean/VoxForge-dev/Main/WebGUI/server/ruby/FixTables.mysql

Therefore, no need for the suggested code patch.