Registration email can be sent out more than once within the initial 24 hour period

[Stacey Walker]

A user can register, and be sent emails, multiple times with the same details prior to completing the registration process from the link sent. There are multiple records in usr_registration with only the sequential id differing.

Perhaps we need to check for a unique email in here and offer some notification to the user that the email has already been used?

However, there is also the issue that if this initial email wasn't received it might not be easy for the user to wait 24 hours until it clears from the database to try again, or to get hold of a sysadmin to delete the record manually so they can do so without hassle so there might be extra requirements around this or this might be the reason it currently allows for multiple records.

[Stacey Walker (stacey)]

I have just tested this between 1.4.0dev and 1.3.4dev and it is happening the same in both.

[François Marier (fmarier)]

Interesting. Are the multiple emails causing a problem or is it just an annoyance?

[Stacey Walker (stacey)]

As far as I can tell from quick testing it's not going to let a user do anything they shouldn't be allowed to. i.e., create two accounts with exactly the same username, email where they should be unique.

But it could result in a bit of confusion if a user thought that maybe their account wasn't being created properly and kept registering etc.

[Ruslan Kabalin (rkabalin)]

Just to keep all relevant information here, the issue was discussed on the forum as well: http://mahara.org/interaction/forum/topic.php?id=2630#post11526

[Ruslan Kabalin (rkabalin)]

> Are the multiple emails causing a problem or is it just an annoyance?

As Sergio suggested on the forum, it is possible though to create two users with the same email by registering twice using different links and specifying different usernames. I see two possible solutions:

1. Leave multiple registration records in usr_registration as it is, but check at the registration key processing that the user with the same email does not exist in usr table.
2. At the registration, ensure that only one record for given email exist (e.g. each consequent registration attempt the record with the same email is being updated with new key and all the data).

[Richard Mansfield (richard-mansfield)]

Ruslan, both solutions sound good to me. I think I have a slight preference for 2 just because it avoids the error screen.

I really wish Mahara had enforced uniqueness of email addresses in the user table right from the start.

[Ruslan Kabalin (rkabalin)]

I have filled in a separate bug #693790 that reflects the original problem.

[Ruslan Kabalin (rkabalin)]

Do you want me to update stable branches (1.2, 1.3) with this fix?

[François Marier (fmarier)]

1.2 is now pretty much only for security fixes, so I wouldn't worry about that one.

In terms of 1.3, I'm not sure how important this is. I mean it's bad that we get duplicate emails but it has always been the case (i.e. not a regression) and while it's easy to do when you know how to do it, it's not so easy to do by mistake.

And I would tend to be conservative in changing the registration code on the stable branch because it could introduce bugs that could be worse. What do you think?

[Ruslan Kabalin (rkabalin)]

OK, let us be on the safe side and leave this fix for master only.