1 (edited by afarber 2006-02-28 10:28)

Topic: Users with invalid e-mails register despite Verify registration: Yes

Hello Rickard and others,

I'm using PunBB 1.2.10 (with English, Russian and German lang packs) under
OpenBSD and with PostgreSQL 8.1.0 here: http://www.preferans.de/forum/

First of all: thank you for the nice forum!

Now to my problem: I've installed PunBB a month ago and already about 30 users
have registered. I'm worried by the few users, which keep registering with an
invalid e-mail address, like from5663@preferans.de or and4676@preferans.de
(I'm sure they are invalid, because I'm the owner of the "preferans.de" domain):

    http://www.preferans.de/forum/profile.php?id=41
    http://www.preferans.de/forum/profile.php?id=42

Interestingly their usernames are the same as their e-mail addresses.

So is it maybe a bug in PunBB 1.2.10? Because I have set Verify registration: Yes
in the Admin - Options. Or are those just unconfirmed registrations, which will be
dropped later (could you please refer me to the .php script which does this cleanup)
and I don't have to worry about those, since they won't be able to login?

And here is what I see in the database (the 2 suspicious users and my config):

punbb=> select * from users where username like '%preferans.de';
 id | group_id |       username        |                 password                 |         email         | title | realname | url | jabber | icq | msn | aim | yahoo | location | use_avatar | signature | disp_topics | disp_posts | email_setting | save_pass | notify_with_post | show_smilies | show_img | show_img_sig | show_avatars | show_sig | timezone | language |   style    | num_posts | last_post | registered | registration_ip | last_visit | admin_note | activate_string | activate_key
----+----------+-----------------------+------------------------------------------+-----------------------+-------+----------+-----+--------+-----+-----+-----+-------+----------+------------+-----------+-------------+------------+---------------+-----------+------------------+--------------+----------+--------------+--------------+----------+----------+----------+------------+-----------+-----------+------------+-----------------+------------+------------+-----------------+--------------
 41 |    32000 | from5663@preferans.de | e618a2d52c4829df50b5b16be791b090ac82d8e8 | from5663@preferans.de |       |          |     |        |     |     |     |       |          |          0 |           |             |            |             0 |         0 |                0 |            1 |        1 |            1 |            1 |        1 |        0 | Russian  | phpbb_blue |         0 |           | 1141115943 | 217.174.249.110 | 1141115943 |            |                 |
 42 |    32000 | and4676@preferans.de  | 9cd4aa97c1157eac18778b7c0a8194b54f7b8b22 | and4676@preferans.de  |       |          |     |        |     |     |     |       |          |          0 |           |             |            |             0 |         0 |                0 |            1 |        1 |            1 |            1 |        1 |        0 | Russian  | phpbb_blue |         0 |           | 1141115989 | 192.138.77.36   | 1141115989 |            |                 |
(2 rows)

I'm worried most by the fact that the 2 fields activate_string and activate_key above are cleared. Does it mean the users have somehow managed to confirm their bogus e-mail addresses?

punbb=> select * from config;
       conf_name        |                                                        conf_value
------------------------+---------------------------------------------------------------------------
-----------------------------------------------
 o_cur_version          | 1.2.10
 o_default_style        | phpbb_blue
 o_time_format          | H:i:s
 o_date_format          | Y-m-d
 o_timeout_visit        | 600
 o_timeout_online       | 300
 o_redirect_delay       | 1
 o_show_version         | 0
 o_show_user_info       | 1
 o_show_post_count      | 1
 o_smilies              | 1
 o_smilies_sig          | 1
 o_make_links           | 1
 o_default_user_group   | 4
 o_topic_review         | 15
 o_disp_topics_default  | 30
 o_disp_posts_default   | 25
 o_indent_num_spaces    | 4
 o_quickpost            | 1
 o_users_online         | 1
 o_censoring            | 0
 o_ranks                | 1
 o_show_dot             | 0
 o_quickjump            | 1
 o_report_method        | 0
 o_mailing_list         | alexander.farber@gmail.com
 o_avatars              | 1
 o_avatars_dir          | img/avatars
 o_additional_navlinks  | 0 = <A HREF="/">Java Pref</A>
4 = <A HREF="/impressum.php">Impressum <IMG SRC="/bundesflagge.gif" WIDTH=13 HEIGHT=8></A>
 o_search_all_forums    | 1
 o_base_url             | http://www.preferans.de/forum
 o_admin_email          | alexander.farber@gmail.com
 o_webmaster_email      | alexander.farber@gmail.com
 o_subscriptions        | 1
 o_smtp_user            |
 o_smtp_pass            |
 o_regs_allow           | 1
 p_sig_img_tag          | 1
 o_regs_verify          | 1
 o_rules                | 0
 p_subject_all_caps     | 0
 o_maintenance          | 0
 p_allow_dupe_email     | 0
 p_mod_edit_users       | 1
 p_mod_rename_users     | 0
 p_mod_change_passwords | 0
 p_mod_ban_users        | 0
 p_message_bbcode       | 1
 p_message_img_tag      | 1
 p_message_all_caps     | 1
 p_sig_all_caps         | 1
 p_sig_bbcode           | 1
 p_sig_length           | 400
 p_sig_lines            | 4
 p_allow_banned_email   | 1
 p_force_guest_email    | 1
 o_board_title          | Preferans.de
 o_server_timezone      | 1
 o_default_lang         | Russian
 o_gzip                 | 1
 o_regs_report          | 1
 o_avatars_size         | 20000
 o_smtp_host            | 127.0.0.1
 o_announcement         | 0
 o_board_desc           | <I>???????? ???????</I>
 o_avatars_width        | 200
 o_avatars_height       | 200
 o_rules_message        | Don't be rude!
 o_announcement_message | Achtung!!!
 o_maintenance_message  | The forums are temporarily down for maintenance. 
Please try again in a few minutes.<br /> <br /> /Alex
(70 rows)

Regards
Alex

PS: Please feel free to register there - then you'll be able to set English as display language
      http://www.preferans.de/forum/register.php

http://preferans.de/ - russian card game

2 (edited by Smartys 2006-02-28 11:53)

Re: Users with invalid e-mails register despite Verify registration: Yes

group_id 32000 means they're unconfirmed
And as for cleaning them:
http://punbb.org/forums/viewtopic.php?id=5936

Re: Users with invalid e-mails register despite Verify registration: Yes

Thank you for the explanation and Connorhd's AP_User_management.php has worked for me too

http://preferans.de/ - russian card game

4

Re: Users with invalid e-mails register despite Verify registration: Yes

Also, verifying email addresses is very hard. A normal way is checking invalid chars, then stripping the username and checking if the host has DNS records. This is as good a verification as you can get. You can't really verify the email address themselves, unless you have set up your SMTP server insecurely...

Any technology distinguishable from magic, is insufficiently advanced.
Official Danish mirror for punbb: http://mirror.ordo.dk/punbb.org/

Re: Users with invalid e-mails register despite Verify registration: Yes

You can't really verify the email address themselves, unless you have set up your SMTP server insecurely

That's not true tongue
http://coveryourasp.com/ValidateEmail.asp (see #3, I don't have a PHP example on hand)
As long as the SMTP server is set up to only respond positively for valid email addresses (which is how it should be) then the email address will be valid