Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

user activation link doesn't enforce frontend base URL #7765

Merged
merged 7 commits into from Oct 1, 2015

Conversation

lcdservices
Copy link
Contributor

#7737 - enforce frontend construction for user activation URL

#7737


when the register method constructs the user activation URL, it doesn't explicitly enforce a frontend URL. this means that 3rd party extensions wanting to trigger registration (and thus activation emails) from a backend tool cannot make use of the core register method.

since the activation URL is only valid from the frontend, we should always enforce the proper construction.

there are two locations to be modified:
https://github.com/joomla/joomla-cms/blob/staging/components/com_users/models/registration.php#L410
https://github.com/joomla/joomla-cms/blob/staging/components/com_users/models/registration.php#L447

In both cases, we can just include the base url inside JRoute::_() to achieve the enforcement:

$data['activate'] = JRoute::_($base . '/index.php?option=com_users&task=registration.activate&token=' . $data['activation'], false);

joomla#7737 - enforce frontend construction for user activation URL
@zero-24 zero-24 changed the title Update registration.php user activation link doesn't enforce frontend base URL Aug 25, 2015
@zero-24
Copy link
Member

zero-24 commented Aug 25, 2015

@lcdservices I have just tested this but it don't work for me.

How to test

  • enable frontend registratration
  • choose "self" registration
  • go to the frontend and register an account
  • click the activation link. --> Works
  • got to the backend and set "admin registration"
  • go to the frontend and register an account
  • click the activation link. --> Works
  • apply this patch
  • choose "self" registration
  • go to the frontend and register an account
  • click the activation link. --> don't work here
  • got to the backend and set "admin registration"
  • go to the frontend and register an account
  • click the activation link. --> don't work here.

expected result

http://www.example.org/dev/e3/index.php?option=com_users&task=registration.activate&token=ab7bc2b688beb2477c103ce4ee5b318b

actual result

http://www.example.org/index.php?option=com_users&task=registration.activate&token=ab7bc2b688beb2477c103ce4ee5b318b

@infograf768
Copy link
Member

I wonder if we need $base here.
Maybe we would just need `JRoute::_(JUri::root() . 'index.php?option=com_users&task=registration.activate&token=' . $data['activation'], false);

@joomdonation
Copy link
Contributor

This code is wrong. And I think the solution is quite simple. We just need to remove administrator/ from $data['activate'] when this method is called from administrator area with this code

if (JFactory::getApplication()->isAdmin())
{
    $adminPos         = strrpos($data['activate'], 'administrator/');
    $data['activate'] = substr_replace($data['activate'], '', $adminPos, 14);
}

I made a small PR to your branch to make it works like that lcdservices#1. Please try to test it and if it works, please merge it so that other testers can test it

use JUri::root() as the base URL rather than constructing via JUri::getInstance()->toString()
@lcdservices
Copy link
Contributor Author

I think the suggestion from @infograf768 is much cleaner and more direct than doing a string replacement after the URL has been constructed. @zero-24 -- can you test the revised PR? I don't have a dev site set up where Joomla is installed in a subdirectory (which is the use case that created the issues you noticed).

@joomdonation
Copy link
Contributor

@lcdservices While the suggestion from @infograf768 works, it always return none-sef URL. Also, I haven't seen anywhere in our core code which pass full URL into JRoute::_ method, so I don't think that the code is good enough.

@zero-24
Copy link
Member

zero-24 commented Aug 26, 2015

hmm generaly it works but it looks like we need to fix is also here:
https://github.com/lcdservices/joomla-cms/blob/patch-1/components/com_users/models/registration.php#L85

We also get with this patch applyed:

error_registratration

But i have no clue why?

@zero-24
Copy link
Member

zero-24 commented Aug 26, 2015

hmm i guess the seccond on was an error on my side. I can not reproduce this again?!

Ok. So only point on need to be fixed see:
https://github.com/lcdservices/joomla-cms/blob/patch-1/components/com_users/models/registration.php#L85

and the comment by @joomdonation

@joomdonation
Copy link
Contributor

@zero-24 I think we don't have to worry at the code at activate method (which you mentioned). The reason is because usually, third party developer only uses register method to create a Joomla user in Joomla core (I use it in my extension too), but for the activate method, I think it is just handled by Joomla core (when users click on the activation link).

@lcdservices
Copy link
Contributor Author

ok...
@zero-24 I fixed it in the additional location you identified
@joomdonation - I really don't like the string replace method -- it's too hackish. but I agree it seems the only way to do this while preserving SEF urls. So I restructured it to handle it in this way.

fixes cs and hopfully make travis happy
@joomdonation
Copy link
Contributor

@lcdservices Could you merge @zero-24 PR so that travis happy and we can get this PR merged?

I use this function in my extension, too, and would love to have this merged in next release of Joomla so that I don't have to change code / fix bugs for client

let travis be a happy guy
@lcdservices
Copy link
Contributor Author

done. sorry, didn't notice he had done it as a PR against my patch.

@zero-24
Copy link
Member

zero-24 commented Sep 18, 2015

RTC based on testing 😄


This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/7765.

@joomla-cms-bot joomla-cms-bot added the RTC This Pull Request is Ready To Commit label Sep 18, 2015
@infograf768
Copy link
Member

Any reason not to use a simpler:
$data['activate'] = str_replace('administrator/', '', $data['activate'])
instead of looking for its position?

@joomdonation
Copy link
Contributor

Might have bug in case you you have a site called administrator

for example, http://localhost/administrator/administrator

Of course it will only happens in that very special case but we should avoid that.

@zero-24 zero-24 added this to the Joomla! 3.4.5 milestone Sep 19, 2015
rdeutz added a commit that referenced this pull request Oct 1, 2015
user activation link doesn't enforce frontend base URL
@rdeutz rdeutz merged commit 881dbc2 into joomla:staging Oct 1, 2015
@joomla-cms-bot joomla-cms-bot removed the RTC This Pull Request is Ready To Commit label Oct 1, 2015
@zero-24 zero-24 modified the milestones: Joomla! 3.4.6, Joomla! 3.5.0 Oct 28, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

6 participants