0

I'm new to this module. Here is my dilemma. I want have only one person be able to register members and I have to do this through a front end template because I want to be able to assign categories to them. Is it possible to have "allow new member registration" turned off and still accomplish this? I've had issues in the past where I had that turned on and got spammed with 1000's of registrations. Any help would be great!

Here is my template code:

{if logged_in}
 {if group_id == 1 OR group_id == 6}
<-- registration fields -->
 {/if}  
{/if}
{if logged_out}<h2>Please <a href="{path=members}">login</a> to view this page.</h2>{/if}

1 Answer 1

2

Well, you should be using either Captcha or a Honeypot in your form; that would really prevent a lot of your issues. You will need to have Allow New Member Registration set to on, but can prevent the spam.

A really simple way to do this on the front end would be to create a user registration form and wrap the whole form in a tag like this:

{if group_id == 100 || group_id == 1}

    {!-- output your registration form --}

{if:else}

    {redirect=404}

{/if} 

Provided the id of your "Member Registrar" group is 100, this will output the form if the logged in user is in the group that's allowed to register people; if not it will redirect to a 404 page. It also allows super admins (group_id == 1) to access the form. Your post success page should be protected from rogue HTTP POST requests since it will require a generated CSRF token.

4
  • ah ok. That makes sense. Seems to be working. Thanks! Dec 5, 2016 at 15:05
  • So I did this and I am getting spam members registered. I've enabled captcha but it's not showing up. Any help? Jan 10, 2017 at 15:02
  • Are you using CSRF properly? Are you member protecting your form and submission pages? Literally, if when not logged in, you can't visit your /sign-up and /sign-up/success pages (testing a post submit to /sign-up/success, you are fine. If you can, you haven't implemented the safeguards I've described properly. Please update your post with template code. ALSO, make sure your default member page is blocked if you aren't using it.
    – jrothafer
    Jan 11, 2017 at 15:55
  • You are probably right. I've revised my question to show what my registration page looks like. When hitting that page logged out it shows the logged out message. What would be the default member page? Jan 11, 2017 at 19:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.