Registrations blocked from offices

nukeador · October 24, 2019, 2:08pm

Hi,

Some people are having problems to register and I guess it’s due using offices fixed ips and a restriction to avoid too many registrations from a single ip:

Can we fix this? Thanks!

tad · November 9, 2015, 9:27pm

Maybe we should obtain a list of “safe” IP ranges that are owned by Mozilla?

I’m sure that @XioNoX would have that information.

Pike · November 9, 2015, 10:11pm

I wonder if there’s a chance to share this data with irc.mozilla.org?

Kensie · November 9, 2015, 11:30pm

So it’s slightly different on Discourse than a straight-up registration limit. Discourse has trust levels, when you first sign up you get trust level 0, but as you do things, you get bumped up to trust level 1, etc.

This setting blocks registrations where there are too many people with trust level 0 and no one of a high enough trust level.

Therefore this will not be a problem for all IPs, and in theory this could naturally solve itself without needing to use a whitelist. However a whitelist would not be a bad idea.

Kensie · November 9, 2015, 11:31pm

Oh and I resolved this particular instance, at least for now.

Pike · November 10, 2015, 11:52am

Can you rephrase this as a recipe for things like hackathons? I’m thinking of a situation where I’d invite the participants to join discourse on a particular topic, and how to estimate if there’s a problem.

At which point does the no-more-no-trust for a particular IP kick in? I.e., what’s the number of new ones that’s OK without worries?

Is me being a member good enough to lift those limits? Does it lift it to some other limit?

Happy to read the code, honestly might even prefer to. Didn’t manage to find it, though.

Kensie · November 11, 2015, 6:46pm

You’re right, this could be a problem in that case. Some options are available, all require advanced notice without disabling the setting itself.

Disable the setting for the duration of the event
Find out the IP and have it whitelisted before the event
Have someone create a new account from the event, and then either have them earn a higher trust level, or have it applied to them
Recommend people create the accounts at home as part of the invitation/sign-up process

Here is an explanation of what the trust levels are: What do trust levels do?

leo · November 13, 2015, 7:02pm

github.com

discourse/discourse/blob/0f7aaf5ab19f593416a0012f223e2f91e6cb0329/lib/spam_handler.rb

class SpamHandler

  def self.should_prevent_registration_from_ip?(ip_address)
    return false if SiteSetting.max_new_accounts_per_registration_ip <= 0

    tl2_plus_accounts_with_same_ip = User.where("trust_level >= ?", TrustLevel[2])
                                         .where(ip_address: ip_address.to_s)
                                         .count

    return false if tl2_plus_accounts_with_same_ip > 0

    staff_user_ids = Group[:staff].user_ids - [-1]
    staff_members_with_same_ip = User.where(id: staff_user_ids)
                                     .where(ip_address: ip_address.to_s)
                                     .count

    return false if staff_members_with_same_ip > 0

    ip_whitelisted = ScreenedIpAddress.is_whitelisted?(ip_address)
    return false if ip_whitelisted

This file has been truncated. show original