self registration is not safe with domain limitation #1111

New issue

Open

opened 2026-02-20 15:28:17 -05:00 by deekerman · 2 comments

deekerman commented

2026-02-20 15:28:17 -05:00

Owner

Originally created by @sbonaime on GitHub (Feb 17, 2020).

Originally assigned to: @NGPixel on GitHub.

Describe the bug
2.1.13
self registration is not safe with domain limitation

To Reproduce

With a wiki address as wiki.bar.com, self registration and domain limitation to bar.com (for instance), register a new user on the login page random with foo@bar.com
A popup window appears with
"Can't send email - all recipients were rejected: 550 5.1.1 foo@bar.com User unknown"
Even if the registration email can't be send because the user does not exist, this message do not need to be so informative. It is a way to find valid login on a specific domain.

Expected behavior
The popup window after registration should be something link
"A registration email has been sent to the provided email if it is valid"

Originally created by @sbonaime on GitHub (Feb 17, 2020). Originally assigned to: @NGPixel on GitHub. **Describe the bug** 2.1.13 self registration is not safe with domain limitation **To Reproduce** 1. With a wiki address as wiki.bar.com, self registration and domain limitation to bar.com (for instance), register a new user on the login page random with foo@bar.com 2. A popup window appears with "Can't send email - all recipients were rejected: 550 5.1.1 foo@bar.com User unknown" Even if the registration email can't be send because the user does not exist, this message do not need to be so informative. It is a way to find valid login on a specific domain. ![Capture d’écran 2020-02-17 à 17-02-20 17 16 29](https://user-images.githubusercontent.com/750709/74670985-84a64200-51aa-11ea-8ad1-261cacde1c73.png) **Expected behavior** The popup window after registration should be something link "A registration email has been sent to the provided email if it is valid"

deekerman added the

enhancement

contrib-easy

labels

2026-02-20 15:28:17 -05:00

deekerman commented

2026-02-20 15:28:19 -05:00

Author

Owner

@sbonaime commented on GitHub (Feb 20, 2020):

Another linked bug :
In the "User unknown" case, the user is still created. It should not ! Also this user cannot be removed due to a "Cannot delete user because of content relational constraints." popup ! Even if this user is invalid, not activated, never login and never created anything...

@sbonaime commented on GitHub (Feb 20, 2020): Another linked bug : In the "User unknown" case, the user is still created. It should not ! Also this user cannot be removed due to a "Cannot delete user because of content relational constraints." popup ! Even if this user is invalid, not activated, never login and never created anything...

deekerman commented

2026-02-20 15:28:19 -05:00

Author

Owner

@despens commented on GitHub (Mar 10, 2020):

It is indeed possible to create a user that would be a random email handle on the allowed domain. That user will idle as "unverified" and "inactive" in the wiki's user list and is impossible to delete, although no content was created by that user.

@despens commented on GitHub (Mar 10, 2020): It is indeed possible to create a user that would be a random email handle on the allowed domain. That user will idle as "unverified" and "inactive" in the wiki's user list and is impossible to delete, although no content was created by that user.