spudley / plg_user_restrictusername Goto Github PK

I thank you for this plugin. Could you add the ability to apply restrictions to the "Name" field as well, in addition to the "Username" field?

The reason is that there are some bots that make automatic registrations by entering web and/or email addresses within both "Name" and "Username". To stop this behavior, it would be sufficient to apply some restrictions.

I installed and enabled plugin in my site having Joomla 3.81 version. But It does not show any sign of action. No result.

Any hope of this being updated to work with Joomla 4 please?

I’ve tried using your plugin to disallow registrations from spam scripts with a definite pattern of usernames — they always end in two uppercase letters. Although the regex I’ve come up with works in a tester (like https://regex101.com/), it doesn’t work in the plugin. I’ve spent quite a bit of time on this, but after trying to add some logging to your code I’ve realised I know too little about PHP and Joomla to even debug it at this point. Could you give me any suggestions to figure out why this isn’t working?

I do two checks — one for the general format and one for the last characters. I think the general format part works as I’ve tested a username with a non-ASCII character and it was rejected. My check for the endings doesn’t work though.

Regex
/^[a-zA-Z0-9._!!"£$%^&*(){}[\]':;~#>,\/\?\|\+=_]+(?![a-z][A-Z]{2})$/

i.e. alphanumeric plus punctuation
^[a-zA-Z0-9._!!"£$%^&*(){}[\]':;~#>,\/\?\|\+=_]+

then not a lowercase char followed by two uppercase chars at the end
(?<![a-z][A-Z]{2})$

Of course, it’s possible there’s something stupid about my regex too. Very grateful for any help you can give.

Edit: I just realised on posting this that the < is stripped from my expression when I save in the plugin, so it ends up as (?![a-z][A-Z]{2})$. Is lookbehind not possible?

This plugin is useful for limiting usernames. But I didn't anticipate the issues that arise where there are existing usernames that don't pass the checks. So long as people just login, all is well. However, a problem arises when a user tries to use the "forgotten password" facility. Presumably because the user record gets saved with some new data, triggering the plugin. The user gets a message about permitted usernames, but can't do anything because they have forgotten their password! And the system won't deal with the password reset while the username is failing checks. I'm wondering what is a neat way to get round this.