CRIN Trac: Ticket #20: Problem adding Drupal user accounts

attachment set

chris — Mon, 15 Jun 2015 13:59:17 GMT

attachment set to image1.png

hours changed; totalhours set

chris — Mon, 15 Jun 2015 18:37:58 GMT

hours changed from 0 to 0.25
totalhours set to 0.25

How exactly did you generate this error?

When I visit the newswletter signup page and complete the form I don't see the same screen as above -- could you explain how I can reproduce this error?

chris — Mon, 15 Jun 2015 18:39:59 GMT

Ignore my last comment, I have found the form.

hours, totalhours changed

chris — Mon, 15 Jun 2015 18:58:06 GMT

hours changed from 0 to 0.25
totalhours changed from 0.25 to 0.5

The anti-spam modules you have enabled are:

CAPTCHA is enabled for the user_register_form with the value reCAPTCHA.

The reCAPTCHA form has a private and public key from Google, it is possible that these are tied to an IP address and you will need to login to Google to get new ones?

Since this form is only available for people with admin access I'm not sure why it needs a reCAPTCHA? Have there been problems with robots using this form?

We could remove it from this form, but it is also used by two other forms, submit_a_resource_entityform_edit_form and webform_client_form_40167 so the problem should be fixed if those forms need it to stop abuse from robots.

jenny — Tue, 16 Jun 2015 08:30:04 GMT

You go to People/ add user - this enables people to edit the website, going to the newsletter sign up page is just to subscribe to that.
Sent from my iPhone
> On 15 Jun 2015, at 19:37, CRIN Trac <trac@trac.crin.org> wrote:
>
> #20: Problem adding Drupal user accounts
> ------------------------------------+-----------------------------------
>                 Reporter:  chris   |                Owner:  chris
>                     Type:  defect  |               Status:  new
>                 Priority:  major   |            Milestone:  Maintenance
>                Component:  drupal  |              Version:
>               Resolution:          |             Keywords:
> Estimated Number of Hours:  0       |  Add Hours to Ticket:  0.25
>                Billable?:  1       |          Total Hours:  0
> ------------------------------------+-----------------------------------
> Changes (by chris):
>
> * hours:  0 => 0.25
> * totalhours:   => 0.25
>
>
> Comment:
>
> How exactly did you generate this error?
>
> [[Image(image1.png)]]
>
> When I visit [https://www.crin.org/en/home/what-we-do/crinmail the
> newswletter signup page] and complete the form I don't see the same screen
> as above -- could you explain how I can reproduce this error?
>
> --
> Ticket URL: <https://trac.crin.org/trac/ticket/20#comment:1>
> CRIN Trac <https://trac.crin.org/trac>
> Trac project for CRIN website and servers.

jenny — Tue, 16 Jun 2015 08:30:05 GMT

I'm not sure if there were problems with robots - Effusion did this. What do you think is the best way forward?
Thanks
Sent from my iPhone
> On 15 Jun 2015, at 19:58, CRIN Trac <trac@trac.crin.org> wrote:
>
> #20: Problem adding Drupal user accounts
> ------------------------------------+-----------------------------------
>                 Reporter:  chris   |                Owner:  chris
>                     Type:  defect  |               Status:  new
>                 Priority:  major   |            Milestone:  Maintenance
>                Component:  drupal  |              Version:
>               Resolution:          |             Keywords:
> Estimated Number of Hours:  0       |  Add Hours to Ticket:  0.25
>                Billable?:  1       |          Total Hours:  0.25
> ------------------------------------+-----------------------------------
> Changes (by chris):
>
> * hours:  0 => 0.25
> * totalhours:  0.25 => 0.5
>
>
> Comment:
>
> The [https://www.crin.org/en/admin/modules#spam_control anti-spam modules]
> you have enabled are:
>
> * [https://www.crin.org/en/admin/config/people/captcha CAPTCHA]
> * [https://www.crin.org/en/admin/config/content/honeypot Honeypot]
> * [https://www.crin.org/en/admin/config/people/captcha/recaptcha
> reCAPTCHA]
>
> [https://www.crin.org/en/admin/config/people/captcha CAPTCHA] is enabled
> for the `user_register_form` with the value reCAPTCHA.
>
> The [https://www.crin.org/en/admin/config/people/captcha/recaptcha
> reCAPTCHA form] has a private and public key from Google, it is possible
> that these are tied to an IP address and you will need to login to Google
> to get new ones?
>
> Since this form is only available for people with admin access I'm not
> sure why it needs a reCAPTCHA? Have there been problems with robots using
> this form?
>
> We could remove it from this form, but it is also used by two other forms,
> `submit_a_resource_entityform_edit_form` and `webform_client_form_40167`
> so the problem should be fixed if those forms need it to stop abuse from
> robots.
>
> --
> Ticket URL: <https://trac.crin.org/trac/ticket/20#comment:3>
> CRIN Trac <https://trac.crin.org/trac>
> Trac project for CRIN website and servers.

chris — Tue, 16 Jun 2015 08:58:19 GMT

Replying to jenny:

What do you think is the best way forward?

A couple of options:

We could try to fix it, the first step I'd suggest would be if you (or me if you give the the login details), check the public and private keys at Google by following the links on the recaptcha page.
We could simply disable the recaptcha on this form, but this would probably means that the problem would remain for the other forms.

jenny — Tue, 16 Jun 2015 09:10:05 GMT

I'm on this page and can see the public/ private keys, but what should I
check/ change?
On 16 June 2015 at 09:58, CRIN Trac <trac@trac.crin.org> wrote:
> #20: Problem adding Drupal user accounts
> ------------------------------------+-----------------------------------
>                  Reporter:  chris   |                Owner:  chris
>                      Type:  defect  |               Status:  new
>                  Priority:  major   |            Milestone:  Maintenance
>                 Component:  drupal  |              Version:
>                Resolution:          |             Keywords:
> Estimated Number of Hours:  0       |  Add Hours to Ticket:  0
>                 Billable?:  1       |          Total Hours:  0.5
> ------------------------------------+-----------------------------------
>
> Comment (by chris):
>
>  Replying to [comment:6 jenny]:
>  >
>  >  What do you think is the best way forward?
>
>  A couple of options:
>
>  1. We could try to fix it, the first step I'd suggest would be if you (or
>  me if you give the the login details), check the public and private keys
>  at Google by following the links on
>  [https://www.crin.org/en/admin/config/people/captcha/recaptcha the
>  recaptcha page].
>  2. We could simply disable the recaptcha on this form, but this would
>  probably means that the problem would remain for the other forms.
>
> --
> Ticket URL: <https://trac.crin.org/trac/ticket/20#comment:7>
> CRIN Trac <https://trac.crin.org/trac>
> Trac project for CRIN website and servers.
>

chris — Tue, 16 Jun 2015 09:13:16 GMT

Replying to jenny:

I'm on this page and can see the public/ private keys, but what should I check/ change?

Follow the hyperlinks to Google and see if the values there are the same and also see if you need to associate a IP address with the forms -- the only thing I can think of that has changed since having the site at GreenQloud is the server IP address.

jenny — Tue, 16 Jun 2015 09:30:08 GMT

Ok, hyperlinks don't appear for me...just keys. I'll send you the username
and password. I've installed privacy badger to send an encrypted message,
but how do I know this is working? Can I just send it via my email address
or is there something else I should be doing that i'm not seeing?
Thanks
On 16 June 2015 at 10:13, CRIN Trac <trac@trac.crin.org> wrote:
> #20: Problem adding Drupal user accounts
> ------------------------------------+-----------------------------------
>                  Reporter:  chris   |                Owner:  chris
>                      Type:  defect  |               Status:  new
>                  Priority:  major   |            Milestone:  Maintenance
>                 Component:  drupal  |              Version:
>                Resolution:          |             Keywords:
> Estimated Number of Hours:  0       |  Add Hours to Ticket:  0
>                 Billable?:  1       |          Total Hours:  0.5
> ------------------------------------+-----------------------------------
>
> Comment (by chris):
>
>  Replying to [comment:8 jenny]:
>  >
>  > I'm on this page and can see the public/ private keys, but what should I
>  > check/ change?
>
>  Follow the hyperlinks to Google and see if the values there are the same
>  and also see if you need to associate a IP address with the forms -- the
>  only thing I can think of that has changed since having the site at
>  !GreenQloud is the server IP address.
>
> --
> Ticket URL: <https://trac.crin.org/trac/ticket/20#comment:9>
> CRIN Trac <https://trac.crin.org/trac>
> Trac project for CRIN website and servers.
>

hours, totalhours changed

chris — Tue, 16 Jun 2015 09:31:37 GMT

hours changed from 0 to 0.1
totalhours changed from 0.5 to 0.6

I have just checked the dblog and there is no error generated by the non-functioning recaptcha.

This is the links to Google (it's the same link on both forms):

https://www.google.com/recaptcha/admin/create?domains=www.crin.org&app=CRIN

I expect you need to be logged into Google with the right account for these to work.

hours, totalhours changed

chris — Tue, 16 Jun 2015 09:53:47 GMT

hours changed from 0 to 0.1
totalhours changed from 0.6 to 0.7

Replying to jenny:

I've installed privacy badger to send an encrypted message

I thought that was a advert and web tracker blocker from the EFF?

It is possible Jonas sent it to me in a GPG email when I was helping link Google Drive to ownCloud, let me check and get back to you.

hours, totalhours changed

chris — Tue, 16 Jun 2015 09:58:07 GMT

hours changed from 0 to 0.06
totalhours changed from 0.7 to 0.76

I do have account details for jonas@… at Google but last time I used it for ownCloud it used two factor authentication, so I don't know if it'll work now he has left, I also don't know of this is the right Google account to use?

hours, totalhours changed

chris — Tue, 16 Jun 2015 11:12:06 GMT

hours changed from 0 to 0.4
totalhours changed from 0.76 to 1.16

I loged into Google using the details provided and there were no sites registered on that account for recaptcha, so I registered crin.org/www.crin.org and installed the new keys, however this hasn't made any difference, so my conclusion is that the recaptcha modules isn't working, I suggest it is disabled (or you get a Drupal developer to look at fixing it, but I understand that this probably won't happen very soon).

To disable recaptcha this form can be used, the nodes it is used by are:

submit_a_resource_entityform_edit_form
user_register_form
webform_client_form_40167

I'm not sure, how to find the URLs of the other two pages where it is in use. Let me know if you would like me to disable recaptcha on all or any of these forms.

jenny — Tue, 16 Jun 2015 11:25:03 GMT

Hi Chris,
Strange as it worked last week...
What would it mean for us to disable these?
The other urls are here: https://www.crin.org/en/user/1/edit
and here: https://www.crin.org/en/home/network/connect/submit_resource
Thanks
On 16 June 2015 at 12:12, CRIN Trac <trac@trac.crin.org> wrote:
> #20: Problem adding Drupal user accounts
> ------------------------------------+-----------------------------------
>                  Reporter:  chris   |                Owner:  chris
>                      Type:  defect  |               Status:  new
>                  Priority:  major   |            Milestone:  Maintenance
>                 Component:  drupal  |              Version:
>                Resolution:          |             Keywords:
> Estimated Number of Hours:  0       |  Add Hours to Ticket:  0.4
>                 Billable?:  1       |          Total Hours:  0.76
> ------------------------------------+-----------------------------------
> Changes (by chris):
>
>  * hours:  0 => 0.4
>  * totalhours:  0.76 => 1.16
>
>
> Comment:
>
>  I loged into Google using the details provided and there were no sites
>  registered on that account for recaptcha, so I registered
>  crin.org/www.crin.org and installed the new keys, however this hasn't
> made
>  any difference, so my conclusion is that the recaptcha modules isn't
>  working, I suggest it is disabled (or you get a Drupal developer to look
>  at fixing it, but I understand that this probably won't happen very soon).
>
>  To disable recaptcha [https://www.crin.org/en/admin/config/people/captcha
>  this form can be used], the nodes it is used by are:
>
>  * `submit_a_resource_entityform_edit_form`
>  * `user_register_form`
>  * `webform_client_form_40167`
>
>  I'm not sure, how to find the URLs of the other two pages where it is in
>  use. Let me know if you would like me to disable recaptcha on all or any
>  of these forms.
>
> --
> Ticket URL: <https://trac.crin.org/trac/ticket/20#comment:14>
> CRIN Trac <https://trac.crin.org/trac>
> Trac project for CRIN website and servers.
>

chris — Tue, 16 Jun 2015 11:31:52 GMT

Replying to jenny:

Strange as it worked last week...

OK, the old server is still running, I'll look at it there.

What would it mean for us to disable these?

The other urls are here: https://www.crin.org/en/user/1/edit and here: https://www.crin.org/en/home/network/connect/submit_resource

I'll let you know.

attachment set

chris — Tue, 16 Jun 2015 11:39:19 GMT

attachment set to greenqloud-admin-people-create.png

hours, totalhours changed

chris — Tue, 16 Jun 2015 11:48:05 GMT

hours changed from 0 to 0.25
totalhours changed from 1.16 to 1.41

On the GreenQloud server I don't see any recaptcha form:

In addition if I submit the form, on the GreenQloud server, without filling in any forms I get this error, which doesn't mention the recaptcha:

Username field is required.
E-mail address field is required.
Password field is required.
English translation of organisation name field is required.
Postal address field is required.
Country field is required.
Organisation name field is required.

How did the recaptcha appear to you when you used the GreenQloud servers?

And I also can't see any recaptcha forms on these pages:

This is checking as the admin user -- should I login as another user to test this?

hours, totalhours changed

chris — Tue, 16 Jun 2015 12:01:14 GMT

hours changed from 0 to 0.17
totalhours changed from 1.41 to 1.58

Comparing the PHP configuration at GreenQloud and on Crin1 the only difference betyween them that I can see that might make a difference is that GreenQloud has:

; This directive determines whether or not PHP will recognize code between
; <? and ?> tags as PHP source which should be processed as such. It's been
; recommended for several years that you not use the short tag "short cut" and
; instead to use the full <?php and ?> tag combination. With the wide spread use
; of XML and use of these tags by other languages, the server can become easily
; confused and end up parsing the wrong code in the wrong context. But because
; this short cut has been a feature for such a long time, it's currently still
; supported for backwards compatibility, but we recommend you don't use them.
; Default Value: On
; Development Value: Off
; Production Value: Off
; http://php.net/short-open-tag
short_open_tag = On

And Crin1 has:

; This directive determines whether or not PHP will recognize code between
; <? and ?> tags as PHP source which should be processed as such. It is
; generally recommended that <?php and ?> should be used and that this feature
; should be disabled, as enabling it may result in issues when generating XML
; documents, however this remains supported for backward compatibility reasons.
; Note that this directive does not control the <?= shorthand tag, which can be
; used regardless of this directive.
; Default Value: On
; Development Value: Off
; Production Value: Off
; http://php.net/short-open-tag
short_open_tag = Off

And if I change this to On on the GreenQloud server then we get the same result -- so this is the cause of the issue.

However I can't find any evidence that the recaptcha was actually working at GreenQloud -- did you ever have a recaptcha form to complete on these pages?

If it didn't work at GreenQloud then I suggest we would be best off trying to switch it off rather than changing this PHP variable.

jenny — Tue, 16 Jun 2015 12:15:03 GMT

Yes, I think we did have recaptcha form. Sure, we can try turning it off. Thanks.
Sent from my iPhone
> On 16 Jun 2015, at 13:01, CRIN Trac <trac@trac.crin.org> wrote:
>
> #20: Problem adding Drupal user accounts
> ------------------------------------+-----------------------------------
>                 Reporter:  chris   |                Owner:  chris
>                     Type:  defect  |               Status:  new
>                 Priority:  major   |            Milestone:  Maintenance
>                Component:  drupal  |              Version:
>               Resolution:          |             Keywords:
> Estimated Number of Hours:  0       |  Add Hours to Ticket:  0.17
>                Billable?:  1       |          Total Hours:  1.41
> ------------------------------------+-----------------------------------
> Changes (by chris):
>
> * hours:  0 => 0.17
> * totalhours:  1.41 => 1.58
>
>
> Comment:
>
> Comparing the PHP configuration at !GreenQloud and on [[Crin1]] the only
> difference betyween them that I can see that might make a difference is
> that !GreenQloud has:
>
> {{{
> ; This directive determines whether or not PHP will recognize code between
> ; <? and ?> tags as PHP source which should be processed as such. It's
> been
> ; recommended for several years that you not use the short tag "short cut"
> and
> ; instead to use the full <?php and ?> tag combination. With the wide
> spread use
> ; of XML and use of these tags by other languages, the server can become
> easily
> ; confused and end up parsing the wrong code in the wrong context. But
> because
> ; this short cut has been a feature for such a long time, it's currently
> still
> ; supported for backwards compatibility, but we recommend you don't use
> them.
> ; Default Value: On
> ; Development Value: Off
> ; Production Value: Off
> ; http://php.net/short-open-tag
> short_open_tag = On
> }}}
>
> And [[Crin1]] has:
>
> {{{
> ; This directive determines whether or not PHP will recognize code between
> ; <? and ?> tags as PHP source which should be processed as such. It is
> ; generally recommended that <?php and ?> should be used and that this
> feature
> ; should be disabled, as enabling it may result in issues when generating
> XML
> ; documents, however this remains supported for backward compatibility
> reasons.
> ; Note that this directive does not control the <?= shorthand tag, which
> can be
> ; used regardless of this directive.
> ; Default Value: On
> ; Development Value: Off
> ; Production Value: Off
> ; http://php.net/short-open-tag
> short_open_tag = Off
> }}}
>
> And if I change this to `On` on the !GreenQloud server then we get the
> same result -- so this is the cause of the issue.
>
> However I can't find any evidence that the recaptcha was actually working
> at !GreenQloud -- did you ever have a recaptcha form to complete on these
> pages?
>
> If it didn't work at !GreenQloud then I suggest we would be best off
> trying to switch it off rather than changing this PHP variable.
>
> --
> Ticket URL: <https://trac.crin.org/trac/ticket/20#comment:18>
> CRIN Trac <https://trac.crin.org/trac>
> Trac project for CRIN website and servers.

hours, totalhours changed

chris — Tue, 16 Jun 2015 12:27:59 GMT

hours changed from 0 to 0.05
totalhours changed from 1.58 to 1.63

Replying to jenny:

Yes, I think we did have recaptcha form. Sure, we can try turning it off.

In that case we should probably try changing the PHP config variable first and see if that solves the issue -- I have changed it -- let me kow if you now have recaptcha forms?