ISSUE SUMMARY:
Two problems occurring during registration process. Have only just noticed them but updates to both Joomla and JomSocial have occurred since last testing but no config changes to the registration process. When going through the registration process there seems to be no email sent out to authenrticate the email address provided by the user. A dud email address can be provided and the account still approved by the admin. I seem to recall that the admin was not asked to approve a registration request until the users email had been authenticated.
On the third stage of the registration process when the user is asked to upload an avatar or skip, if an image is selected it seems to upload and then the registration page hangs. Pressing skip at this stage allows the stage to be completed but no avatar is visible in the profile.

STEPS TO REPLICATE:
1Register as new user
2Provide dud email address
3Load an avatar (if you get to the next screen the problem was transient!)
4Wait for admin approval for the registration
5Log in available
RESULT - succesful login with no email authentication and no avatar visible
EXPECTED RESULT - no email sent to admin without email address authentication
BROWSER - Firefox and Chrome

Hi,

about registration email, please changing joomla mail config to using SMTP instead of phpmailer. I cant have a look into this issue, because login detail that you provided only for administrator level, not super user.

and about avatar issue, that because there is jomsocial home at main menu item as non public access level.
you must set it at public access level.

here common mistake for jomsocial menu items setup:
documentation.jomsocial.com/wiki/Toolbar_Explained

Regards

Hi Albertus,
Sorry about wrong access level - now fixed.
Have changed mail in Global Config to SMTP - can you explain why this is necessary and whether it needs to stay set like this or is it just for diagnosis?
I am reading the documentation to try to understand the avatar issue but am not clear what menu item you are referring to

HI Albertus,
I have read the document a few more times now. When I display the Edit Menu Item I see no ID displayed but I can see that the ID varies on different pages. It's difficult to figure out what is going out without seeing the ID for each item so I will need to dig some more to find out how to get the ID dispalyed on the Edit page. Hopefully it will be something obvious (and stupid on my part) that you will see when you next look at the site.

Hi Albertus,
Have dug further and found all the IDs and my Jomsocial elements are picking up from several main menu entry points. This means I had 6 different IDs in use. I have unpublished all these menu items except the JomSocial entry page in the main menu and the IDs within JomSocial are now all the same. That has fixed the Avatar upload problem. It means I'll have to rethink my menu system but that can come later.
I have changed the email mechanisn to SMTP but that has not fixed the email authentication problem so I'd be grateful if you could still investigate that.
Many thanks

Hi,

please edit your first post at this topic. and put FTP access detail at site info form. I need it for debugging purpose.

Regards

FTP access added

Hi,

please check it. the issue because at jomsocial backend > configuration > site > Enable Multiple Profiles = Yes
but there is no any multiple profiles. after I set to No.

now super users will get the email for user activation.

Regards

Albertus,
The problem is still not fixed.
There is still no verification of the users email address happening before the admin is asked to approve (and activate) the users account. In the past when a registration request was made an address verification email was sent to the email address of the user so that their email address could be verified before the admin was asked to appropve and activate the account. Now as soon as the registration form is completed the admin is asked to approve it. The step to verify that the email address is valid is not being performed.
The problem is not that the admins weren't being informed when a request was made, the problem is that the admins are being asked to approve requests coming from non-existant email addresses.

Hi Albertus,
When a user registers they DO receive the email that includes their username and password but it DOES NOT include the verification token they need to click on so that their email address is verified. I had thought these were two separate emails but it looks as if the email is sent - but it does not include the token. The registration process at the backend still proceeds even though the token is neither issued nor responded to.
Is it possible that there is some conflict between the Joomla and JomSocial registration processes that has come about because of recent upgrades? I am running the current versions of both software products.

Hi,

I marked this issue as confirmed bug. developer need to take care this issue.
please wait for the fixes.

Regards

Hi Jon,

Project Manager said this is not bug, but this is by design.
if you not agree with it, you can put user voice at here:
uservoice.jomsocial.com/forums/101561-jo...ial-feature-requests

or escalated this topic.

Regards

I do not understand how this can be a design decision.
It means that the JomSocial administrator can be flooded with requests from bogus email addresses for access to the site.

The process for New User Account Activation in native Joomla is (and I quote):
" Admin - It is necessary that an administrator approves the account. Here is how the process goes:
• After registering the new user receives an e-mail message containing a link with a token to verify their e-mail address;
• After the user's e-mail address has been verified, all users with the Receive System Messages option enabled will receive an e-mail message notifying them that a user has verified their e-mail address and requests that their account be activated. That email message will contain a link with a token to activate the account;
• Once an administrator has activated the account, the user will receive an e-mail message notifying them that they may now login."


JomSocial no longer sends the token to verify the e-mail address which seems to be a fundamental precaution to avoid spam requests. Instead it sends the email to the admins requesting activation (even when the address is bogus) - I do not understand how this can be a sensible approach to help site management. Is the admin then supposed to approve the request and allow access or go through a manual process to confirm the email address.

Perhaps I have misunderstood the way to manage user registration but this seems to be a bug to me.

I will complete a feature request to ask that JomSocial supports the registration process provided by native Joomla but I would also ask that the design team provide an explanation of their decision to circumvent the native Joomla security precautions making the load on the administrator significantly higher. It is also a change from earlier versions of JomSocial that used to send out the token.

I will also escalate the topic but this is not a reflection on your responses which I have found helpful.

Hi,
I was just going to add the feature request but realised it would likely be rejected as reporting a bug which would infuriate me.
My design request was going to say:

"The recent design decision to not send out the account activation process token to verify a user's email address when account activation is administered causes an increased admin load. It would be great if you could support the native Joomla User Registration process as per the following:

How JomSocial Implements This (from your wiki page - documentation.jomsocial.com/wiki/Explaining_User_Profile )

When a user is created, it is stored in the Joomla Users' database. All mandatory fields such as Name, Username, Email, and Password, are stored into Joomla #__users table
JomSocial then uses that information and adds Custom Profile Fields, Friends System, Private Messaging, Photo and Video Galleries, etc.; however, JomSocial will never:

Control the session of the user.
Handle the logins/logouts or activations.
Manage passwords resets.
It will NOT handle any registration emails. It will however provide HTML template for those.
All that is strictly handled by Joomla itself."

Can you clarify how the design decision to not send out the email verification token follows the principles in the documentation.
I will not raise the feature request for the time being while I await a response.