By dkabal on

I have been getting hundreds of spam registrations to my Drupal 7.x site for the last 4 months. The site has been set to:

Registration and cancellation > Who can register accounts? > Administrators only

for the entire time, so I venture to guess this was introduced 4 months ago (i.e., the site has been operational since early 2012, spam registrations started 4 months ago). Viewing the changelog for Drupal 7.19, it does not address any issue like this, so I would imagine this is still a hole in my installation.

As far as I can tell, they can only register, but the accounts all appear to be blocked, but they shouldn't even be able to register according to the setting above.

Let me know how to escalate this or report this in a more "correct" way.

Cheers,
Dave

⋅ Categories: Drupal 7.x

Comments

vm’s picture

vm commented

That's not occurring on any of my D7 sites. That said, I'd look at any contrib modules which are possibly outdated and/or that interact with user registrations. I'd also check any/all users with elevated roles.

Is there an access denied served when logged out and pointing the browser to /user/register

dkabal’s picture

dkabal commented

I use logintoboggan (up-to-date).

If I attempt to go to privileged content, I am greeted with a login/register page.

zerogravity’s picture

zerogravity commented

Just some info I found on this point in case it helps anyone who lands here

I have :
- user registration by administrators only
- logintoboggan running, with unified login/registration page

There is no link present anywhere in my site to a user registration page of any kind, and I get access refused (403) if I attempt to load mysite.com/user/register or mysite.com/admin/people/create or similar. But I am still getting spam users. The users never login and they show up as "blocked" in the user list, so there is no real danger apart from a bloated user table.

This thread https://drupal.org/node/1883170 puts forward the idea that the culprit may be the unified login/registration page. Indeed even though the registration form is not visible, I do see in the page source of the unified login/registration page that a registration form (wrapped in a div with id="register-form") is present below the login form and supposedly exploitable by bots.