This has been brought to my knowledge by an user of one of my recent installations, but until now I've been to lazy to follow up: We had a TemplateLogin in place, no login names (
{Register}{AllowLoginName} = $FALSE;
). and finally,
{AntiSpam}{HideUserDetails} = 1;
. After registering, he received a mail saying
Login as "0".
I can easily reproduce this. The root cause is that the mail text is composed in a session which does not really belong to the user who is about to register. It can either be
guest
, or as well any authenticated (probably unprivileged) user who visited the registration page to register someone else. Therefore, it doesn't work to use
%USERINFO{}%
for variable substitution in the configuration mail: It doesn't expand anything unless an administrator performs the registration.
Also to be handled under this item: The same welcome message contains a note
If you got this e-mail by mistake: Somebody ([_1]) registered at the [_2] site using your mail address [_3]. The inserts [_1] and [_3] are filled with data from the registration form. For [_1], this is just wrong when someone in an authenticated session (as in case 2 above) did the registration.
In both cases, either the registration code itself has to do the substitution outside of the usual TWiki variable expansion, or the expansion of %USERINFO{}% needs yet another special case to handle. I'm not sure which is uglier.
--
TWiki:Main/HaraldJoerg
- 2017-11-30