Hey pedigree,

This sounds perfect for what I need.

Thanks for taking the time to upgrade the Mod. ;)

There are a several batches of registration attempts in the vbStopForumLogs where maybe as many as 20 registrations by the same username/IP are listed, and the log Message shows "Allowed Registration," yet no user account was set up. When these occur, I add them to the SFS database.

What should I make of this, if anything? ...and why was no account created (though I'm not complaining!)?

As covered elsewhere in the thread, this happens when it passes sfs tests and then passes control back to vB for its tests. The registration has failed vB checks/validty and the text really should read "passed SFS testing, passing back to vB for further tests" but thats just way too long.

0.7, its been changed to "Passed"

Oh, I always thought these entries were from bots who couldn't finish the signing up process. Perhaps they still are.

Hey pedigree,

I have a quick question if you don't mind. I have a bunch of pages building up. Is it wise to keep them or should I prun them?

My main concern is if I prune them, the same people will try to register again. Or won't that matter?

Thanks ...

I'd add signatures to that list!

And possibly some way to add all the failed registrations (cfr "vbStopForumSpam Logs") to the SFS DB in a less repetitive strain injury inducing way than copy name -> ctrl-tab -> paste -> ctrl-shift-tab -> copy ip -> ctrl-tab -> paste -> ctrl-shift-tab -> copy email -> ctrl-tab -> paste -> submit -> backspace -> ctrl-shift-tab -> rinse -> repeat. Assuming the IP check is done first, about 10% of registrations seem to come from IPs unknown to the SFS DB, would be nice if we can preemptively exclude those from other board's registration queues :)

@mmurtha - purging logs wont impact anything else. They use minimal database space

@bartech - Ill see how easily I can add failed registrations to the database but as theyre failed, theyve already been caught and are, mostly complete, in the database. It should be as easy (from your point of view) of a tick box that will post back to the code Im writing for the user functions.

Sorry...hadn't read but a couple hundred of the posts and must have missed the one you're referring to. I thought that was might the case, but the IPs and emails were not on my banned lists. One did get through this morning, however, after 11 attempts.

Ditto signatures, as well as homepages. Basically clean the profile. Don't forget profile fields. They LOVE to place URLs in custom ones.


I'd add a button to the end of the row of the log that submits the data. I know I've submitted a lot based on the fact that they're attempting every 3 seconds for 5 min straight. NOT HUMAN! Doesn't hurt that I have another mod that doesn't let you hit the register button for 15 seconds. This way you know if they're hitting it quicker, they're automatic spammers.

Pedigree, at one time you had talked about the possibility of allowing a custom name for the signup link to circumvent (speed bump) script kiddies.. is that still on a wish list somewhere?

I also recall talk of an option to disable registration when javascript is not active.

skippy

Yes, its on my list and it will work like this.

- the register page will maintain a database table with the last time a certain IP address accessed this page. Its an IP address rather than a vB allocated session as the session can be changed very easily with any POST to the page.
- if the register page has already been accessed within a configurable period of time, the page returns an error and no further processing is done. If a time out window is allocated, then a countdown counter is added to the submit button
- the "submit registration" input button is removed from the template and replaced with a javascript implementation of the removed code, ie document.write("<input>...."). The javascript also writes an encoded javascript code block, linking in a AES decrypt function and an encoded key/challenge pair. The script will decode the AES encrypted javascript that will write a random form field. If that form doesnt exist on the post, its a spambot as a non-javascript browser wont see the submit button but rather a "javascript required" message. This differs from other field scripts in that it will have to AES decode javascript and execute (or give this script individual consideration) in order to get the correct field data, where others are easier to process as the spambot can read field text directly out of a HTML page.