Item7481: Admin should be able to add new users even if EnableNewUserRegistration is off

{Register}{EnableNewUserRegistration}

is convenient to prevent users from registering themselves. (I recently helped a client by removing approximately 300 "Spam" users from the htpasswd file!).

However, a TWiki Admin should be able to add new users (run the register CGI script) regardless of the setting of this configuration variable.

That is, if someone is logged in to TWiki and their ID has Admin permission, this should override the {Register}{EnableNewUserRegistration} setting.

I expected that it would and was surprised when I got an error that I could not run the script.

Yes, the Admin can go to configure, reset the setting, add the users, reset the setting, but this is brittle. They could forget turn to turn this setting off again. Spammers could access register during the period that Enable is on.

(Personally, one of the things that I do is to protect the register script with Apache's access configuration options, the same way that I protect configure. We could recommend this in the docs.)

FYI: I really like the code in TWikiRegistration that sets a NOREGISTRATION variable to disable the form fields unless context registration_supported. When Admins are allowed to add users at any time, this could be expanded as

   * Set NOREGISTRATION = %IF{"context registration_supported" then="%IF{"'%USERNAME%' ingroup 'TWikiAdminGroup'" then="" else="DISABLED"}%" else="DISABLED"}%

-- TWiki:Main/VickiBrown - 2014-04-05