Forum OpenACS Development: Registering does everything, but it does not redirect to a page that says "check your mail for verification link"

After I click OK on the registration form, it directs me to a blank page that has title "Account Closed". Meanwhile, it has correctly sent the email with the verification link in it, which works fine.

When looking at the code and the parameters, they look normal, and it looks like a lot of flexibility has been built in, for example, there is a variable for where to redirect after the form is submitted, and there is a way to customize the form. Has that customization been broken? I don't remember changing the parameters having to do with registration, so I'm not quite sure what's up. Any help here?

-Jim

Hi jim.

I can confirm that the behavior is/was not correct when RegistrationRequiresEmailVerificationP or RegistrationRequiresApprovalP was set. The reply was sent via util_user_message, but this message was never displayed, since the user was logged out (causing a reset of the session_id). I have changed now in the oacs-5-8 branch the delivery mechanism of the message. For details see here: http://cvs.openacs.org/changelog/OpenACS?cs=oacs-5-8%3Agustafn%3A20140416181614

In this process, i found one more bug, where the message of a ad_returnredirect was not shown on the target page, because it was already consumed from the template of the redirecting page.

I wonder, how long this was already broken. Many thanks for reporting.

You're welcome; and yes I needed a fix for this myself, and I also thought it was important to keep up with the legal thing, at least in the US so that the system knows that when people sign up, they own the email address.

In answer to your question, I believe it was working in 5.7.

Other than this, when I was working on this, I wanted to get thru the code and find the problem; a lot of things confused me. Could you say more about what you did leading to you discovering what the problem was?

-Jim

PS, two issues remain:

1 when deleting a user permanently from /acs-admin/users/one, it deletes the user properly and then (I guess as redirecting?) says "You don't have permission to admin ."; admin is still logged in, as evidenced by visiting other pages, I can get to the admin-protected pages, and I still see the developer support panel.

2 (as observed by a registering user) the system sends two emails right away, the verify email and the "here's how you log in, here's how you change your passwd" email; I would have thought the second email should only be sent once the user clicks on the verify link.

Almost forgot to say: the change to user-new.tcl had the desifed effect, that is, when the user hits OK on the reg form, it redirects properly to the page that has the user check his/her email.

One thing about the change confused me, I was wondering whether you removed the call to export_vars because it was unnecessary? Does X always equal [export_vars -base X] for any replacement for X?

Dave Bauer: I noticed the cvs shows that you put the export_vars call there (see Gustaf's link above), and I wanted to find out what was your thoughts developmentwise and stylewise? Is it, for example, that you want to put an export_vars on anything that's a URL? Do you want it there so that you can later add vars to export thru the url?

-Jim

Regarding the delete issue... as a test, I commented out the whole if statement (with the delete commands) in /packages/acs-admin/www/users/selece-user.tcl, and then tried to delete the user using that interface, and the result was, it came back to the /acs-admin/one page correctly -- since the to-be-deleted user still existed.

This suggests there is something wrong with the page flow: if the user is to be deleted, the return url should not point at one.tcl, instead, maybe it should go one page back, to the list of users, /acs-admin/users/complex-search with whatever parameters were originally fed to it.

-Jim

A much easier possibility is for de;eting to redirect to /acs-admin/users, which doesn't need parameters.

-Jim

Anwering all your questions takes longer than fixing the bugs :)
Other than this, when I was working on this, I wanted to get thru the code and find the problem; a lot of things confused me. Could you say more about what you did leading to you discovering what the problem was?
Yes the code is more complicated than it probably has to be. Furthermore it has many hooks for configuration, which are probably there since there are needs for this in the wild. Restructuring will probably fix existing code.

For fixing, i did the following 3 things:

  1. try to understand how the code is supposed to work (i.e. the user-notification via util_user_message)
  2. try ad_returnredirect -message "hi gus!" /ds/shell from ds/shell. Since this did not show the message, it was clear that notification after registry would not work either.
  3. it was a surprise, that the message still did not show up. i digged into util_user_message, found it linked to the session_id, checked, where it was reset, and this was it.

Concerning export_vars: this was a call to export_vars without listed variables for export. It "exports" nothing and can be replaced. Maybe this is a leftover from a parameterization earlier, or it was introduced via cut&paste.

Concerning combining the two message: please write a RFE into the issue tracker.

Concerning the message "no permission to admin...": maybe i can look into this the next days.

all the best
-b

Gustaf, wait a bit before reading this one, it's slightly less important. For now, I assert the statement in the next paragraph; read the rest in a day or so.

The messages should not be combined, and I believe I can prove this.

First, what they contain:

- first comes the email-verify link message, you click on it to activate your acct

- second message, contains "how to log in" with a link and "how to change your passwd" with a link.

Proof should be: you cannot chase any links in the second without first clicking on the verify link, QED, so the messages should not be combined, and they should each be sent at the right time.

The verify link is already sent at the right time, and the right time for the second is after they click the verify link, because at that time, they can actually log in and do stuff.

-Jim

PS, the "you don't have permission to admin" is also slightly less important. The message is actually a lie, and is actually saying "user that was just deleted has no permission to admin some object".

(these next few messages are notes about what I found)
(Gustaf, you may find these notes helpful if you decide to dive into this stuff.)

I started with some text from the email that invites me to change my passwd, to find what in openacs uses it...

The text from the email that I used, was 'Please visit the following link to change your password now', and it turns out the only place this text is found, is in the localization catalog of the acs-subsite package.

Looking at that catalog, I found that the name of that message is "acs-subsite.email_body_Registration_password", and, the only place it's used is on line 516 of the file /packages/acs-authentication/tcl/local-procs.tcl.

Looking in that file, it's a proc that refers to that message, and that proc is named auth::local::registration::Register.

Inside that proc, is a call to the proc that sends the mail, its name is auth::password::email_password.

I'll make some notes similar to this about the email that contains the verify link.

It looks like Lars Pind was in the middle of either refactoring or else deciding what to refactor, and it looks like he wanted to move at least some of the code into the auth subsystem. Does anyone think we should try to finish what he started?

-Jim

(just notes showing where some things are in the code)

This one is about where the verify link email is sent.

The text from the email I used to locate the string in the code, is "This message is to verify that the email address you registered with".

It was found at line 346 of file /packages/acs-subsite/catalog/acs-subsite.en_US.ISO-8859-1.xml; the name of the message in that catalog is lt_To_confirm_your_regis.

That message was found in two places, one is the design document for the auth subsystem (line 1250 of file /packages/acs-core-docs/www/xml/kernel/ext-auth-design.xml), and the other is on line 1518 of file /packages/acs-authentication/tcl/authentication-procs.tcl and the full name for the catalog entry is acs-subsite.lt_To_confirm_your_regis .

acs_mail_lite::send_immediately was used in the proc auth::send_email_verification_email to send the verify link email to the user.

There are three mentions of this proc in the file /packages/acs-authentication/tcl/authentication-procs.tcl -- incl the definition starting on line 1502 -- the two uses are line 986 in the proc auth::create_local_account (line 815), and line 1435 in the proc auth::check_local_account_status (line 1400).

I'm guessing the email was sent by auth::create_local_account.

Pausing for now. My next step is probably to read that design document.

-Jim