Disabling user registration - suffering from a bug?

klaafstra99 · Hangin' Around Joined: Feb 20, 2007 Posts: 32

Hi All,

To start: slap (that was me hitting myself for installing 8.0) I didn't know better at the time.... but... now I do...!

Until 2.10 of Ravennuke is released, I would like to know if it's possible to patch 8.0 for disabling the user registration. I followed all the instructions on phpnuke.org and also disabled the link in my forum for registering.

By some SQL injection or PHP issue, some hackers (considering the domain names and emails used) are able to register. The apache logfile only reports a POST action in the your account module:

Quote:

84.19.182.23 - - [23/Feb/2007:06:11:27 +0100] "POST /ovh/modules.php?name=Your_Account HTTP/1.0" 200 19956 "http://ovh.dyndns.org/ovh/modules.php?name=Your_Account" "Mozilla/4.0 (compatible; ICS)"

Any suggestions? My site can be found here:

Only registered users can see links on this board!
Get registered or login to the forums!

Installing Sentinel would maybe help, but since 2.10 is almost released, I prefer to wait for that. Are there other known (easy to apply!) patches?

Greetings,

Martijn

evaders99 · Moderator Joined: Apr 30, 2004 Posts: 2749

Well here's a very simple fix

in modules/Your_Account/index.php
Add anywhere after the mainfile.php line

Code:

if ($op == "finish") {
die("Registration is disabled.");
}

Not the most user-friendly, but it should work