Even though Account Settings --> Registration and Cancellations --> Who can register accounts? has been set to Administrators only, anyone can register (though the registration is still blocked) once the Persistent Login module has been enabled.

Comments

David4514’s picture

The code in persistent_login.module that follows is what is bypassing the Account Settings:

/**
 * Implements hook_menu_alter().
 */
function persistent_login_menu_alter(&$items) {
  $items['user/register']['access callback'] = 'persistent_login_user_reauth_access';
}

Is there a way to test for the Administrators only setting for who can register a new account? If there is, then possibly this menu item should only be added if that has not been set.

David4514’s picture

In the following code, a test to see if user registration is allowed if first performed. If it is allowed, then the 'user/register' item is added.

/**
 * Implements hook_menu_alter().
 */
function persistent_login_menu_alter(&$items) {
  if (user_register_access()) {
    $items['user/register']['access callback'] = 'persistent_login_user_reauth_access';
  }
}

I do not know if this would impact anything else in the module, but it seems to fix my problem. A patch for this is attached.

David4514’s picture

In the following code, a test to see if user registration is allowed is first performed. If it is allowed, then the 'user/register' item is added.

/**
 * Implements hook_menu_alter().
 */
function persistent_login_menu_alter(&$items) {
  if (user_register_access()) {
    $items['user/register']['access callback'] = 'persistent_login_user_reauth_access';
  }
}

I do not know if this would impact anything else in the module, but it seems to fix my problem. A patch for this is attached.

David4514’s picture

The submit of the above comment failed and the patch was not attached. I'll try again.

gapple’s picture

Status: Active » Needs review

The menu alter was added to address #784942: Hide login form 'Request New Password' link when only 'verifying' password; I don't think your patch will cause that issue to re-appear, but would like to confirm that.

gapple’s picture

Priority: Major » Normal
rlmumford’s picture

Status: Needs review » Needs work

This patch is going to cause problems, as hook_menu_alter is only called on a cache clear. If the user who was logged in when the cache was cleared was able to register accounts, everyone will be able to. You'll need to edit the persistant_login_user_reauth_access to solve the problem.

gapple’s picture

Status: Needs work » Needs review
StatusFileSize
new1.25 KB

Thank you for raising that issue, @rlmumford.

I believe this patch should solve the issue, by calling user_register_access() instead of just user_is_anonymous()

gapple’s picture

StatusFileSize
new1.7 KB

And here is a patch for 6.x

gapple’s picture

Title: Enabling Persistent Login Allows all users to Register » Enabling Persistent Login Allows all users to access Register page
Assigned: Unassigned » gapple
Status: Needs review » Fixed

Both patches seemed to work with a quick test; 'Register' link is available if registrations are open, but is not available if registrations are closed, or the user is logged in via PL.

Fixed in commits:
c40392b74a8502b4c1334d06adce2425090b4e75 (7.x)

6497158605a5bafc610bb33871f5743a3844ceb5 (6.x)

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.