XOOPS 
Forum
Forum Index General Forums Community Support Modules Support Themes Support Development International Support Module Hack Reviews Theme Designer Talk
  1. Board index / 
  2. XOOPS Community Support forums / 
  3. Q and A 
  4.  / Possible security breach
Register
1
lavaburst
Possible security breach

  • 2004/7/10 21:15

  • lavaburst

  • Just popping in

  • Posts: 77

  • Since: 2004/6/13


Hi, Im running XOOPS2.0.7 and this morning noticed a malicious new username. after looking at the email address of the new user, i checked the domain name... it was not registered. So, my concern is, how can a user gain registered user access with an invalid email address? I checked the profile and looked at the last login date/time. This does not seem to match with the access log.

Any ideas would be great... what is done on XOOPS about possible security holes?


Thx, lavaburst
2
Stewdio
Re: Possible security breach

  • 2004/7/10 21:23

  • Stewdio

  • Community Support Member

  • Posts: 1560

  • Since: 2003/5/7 1


Chances are the user changed their email address after registration to avoid spam or beef up personal privacy concerns.

You could disble users from changing their email address in your preferences, although users will groan about that.

XOOPS does not revalidate an email adress if it has been changed after initial registration.
3
lavaburst
Re: Possible security breach

  • 2004/7/10 21:28

  • lavaburst

  • Just popping in

  • Posts: 77

  • Since: 2004/6/13


Ok, thats good to know.. i wasnt aware of that possibility...

Still, they used for their username the same name as my domain. so im gunna havta delete them.


Thx for the tip, im not as concerned with that new info.


Cheers
4
ali44
Re: Possible security breach

  • 2004/7/11 3:59

  • ali44

  • Just popping in

  • Posts: 86

  • Since: 2004/5/24


They user need not to have a valid email address to activate the account. The email account can be a forward one, for example, if I own a whatever.com, I forward all the email from whatever@whatever.com to go to my yahoo (or any valid) email address, i can click on the link to activate the account.
5
koertzen
Re: Possible security breach

  • 2004/7/11 4:53

  • koertzen

  • Just popping in

  • Posts: 79

  • Since: 2003/10/22


You can also prevent someone from creating any user name that you want to reserve. These are found in the preferences in the system admin module. I would suggest a best practice would be to always reserve user names that are similar to your domain name as well as 'admin', 'webmaster', etc.
6
wtravel
Re: Possible security breach

You can also prevent users from using a number of specified domains in their e-mail addresses. This option can be found just below the reserved usernames field.

Regards,

Martijn

Login

Register now!  |  Lost Password?

Search

Advanced Search

Recent Posts

Who's Online

168 user(s) are online (97 user(s) are browsing Support Forums)

Members: 0

Guests: 168

more...

Donat-O-Meter

Stats
Goal: $100.00
Due Date: Apr 30
Gross Amount: $0.00
Net Balance: $0.00
Left to go: $100.00
Make donations with PayPal!

Latest GitHub Commits