Removing Users is Vital!

[janer]

Hi,
I have picked up from previous correspondence that it is impossible to remove a user once registered. That means that my system is going to gradually drown under the weight of WebBot registrations. I have been systematically clearing them (ie Removing) weekly - usually at least 6 a week. I hadn't realised that Remove didn't mean what it said, until I recently wanted to enroll a user as an Author, and discovered all those wretched WebBots in the list of names that was presented.

Please, please provide a way of permamently getting rid of names that have no other links inside the site - just the thought of them all still lurking there gives me the heebie-jeebies, but the thought that they will just accumulate is terrible!

Many thanks

Janer

[jmacgreg]

Hi Janer,

You can delete users permanently using the Merge Users feature as either a Site Admin or a Journal Manager (more info available here).

I do agree that there should be a batch merge kind of feature though: I've reported this here: http://pkp.sfu.ca/bugzilla/show_bug.cgi?id=4857. Please feel free to CC yourself for future updates.

Cheers,
James

[janer]

Dear James,

Please could you explain how 'merging' actually gets rid of an unwanted registration by a web-bot! What do I merge it with - and doesn't that still leave me with a mangled entry on the list that I still don't want? Do I then start merging these merged entries and so on??

I am extremely disappointed having followed your link below that the decision is to defer this feature in the next upgrade - I am still having to 'Remove' up to 5 spam registrations every week - but I know they are still there!! Doesn't your colleague understand this particular problem - there should deinitely be a DELETE feature never mind merging because there is absolutely no way I want these spam entries on my lists!! Could you ask him to rethink please?

Many thanks

Janer

[asmecher]

Hi janer,

The "merge users" tool will not leave garbled entries in the database -- it removes the user entirely, transferring any assets (e.g. submissions) to another user you specify, i.e. yourself.

The batch merge/delete was deferred because we had already entered the testing and translation update processes. In the meantime, the fastest way to remove large numbers of accounts is via a database tool like phpMyAdmin.

To prevent spam registrations, I'd suggest using CAPTCHA testing -- see your config.inc.php (or search this forum) for more information.

Regards,
Alec Smecher
Public Knowledge Project Team

[michael]

Hi Janer,

You can also remove/merge multiple users using the command-line version of merge users. For example, if you create an account called 'spam' to use as a catch-all account for merging other accounts into, you can use the command-line tool as:

Code: Select all

 php tools/mergeUsers.php spam someaccount

This would merge and remove 'someaccount' and associate all its db records with the 'spam' account.

You could extend this with a shell script once you've identified all of the spam accounts:

Code: Select all

!#/bin/bash

php tools/mergeUsers.php spam someaccount1
php tools/mergeUsers.php spam someaccount2
php tools/mergeUsers.php spam someaccount3
...


Cheers,
Michael

[RickMath]

Hi Janer

I hope the PKP people do not mind me entering some comments in this post. I do not mean to confuse the issue.

I had a continuuing problem with BOT created users.

Do you have access to your MySQL database? If so you can remove the users here. Don't forget to also remove the user settings for the same User_IDs.

I got rid of them all using my approach but you could also use the approaches the Alec has suggested.

Either way I would suggest that you turn on or have your adminstrator turn on the captcha feature in the config.inc.php file. Since I did this a week ago there have been no BOT invasions. I like you was getting several every day. See some of the other posts on captcha. I have it implemented in both OJS and OCS.

Hope this helps you for future invasions.

Rick

[asmecher]

Hi all,

Thanks, Rick -- and FYI, the next release of OJS (version 2.3.2) will allow for merging of several accounts at a time.

Regards,
Alec Smecher
Public Knowledge Project Team

[janer]

Thanks to all - the limit of my personal IT ability is to turn on Captcha which I have now done with fingers crossed that everything else still works OK!

Cheers
Janer

[janer]

Further thanks to all - Captcha works - magic - so at least I don't get any new spam registrations now, and have to waste time trawling through the lists to disable them.
Best wishes

Janer

[janer]

Hi All - disppointment now! I have not only got rid of spam registrations, I have got rid of all of them - nobody could register because the captcha function didn't actually work - nothing appeared in the captcha box on the registration page only a little red cross!

So I have had to turn captcha off again, and am waiting for the web-bot invaion to start again.

Please could anybody offer me a fix for this - doesn't captcha work with version 2.2.1?

Many thanks
Janer

[RickMath]

Janer

I had a similar problem at first. It turned out to be the font location. Have you checked the path? Read through my post here viewtopic.php?f=2&t=5610

I have had the captcha working consistently since in installed the fonts in a folder under my OJS path.

Hope this helps. I know how frustrating these little issues can be.

Rick

[timmcgeary]

I'm of the same position that you've got to be able to remove users out of the database, but I do understand the need to transfer submissions from authors. However, getting rid of users with no record attached to them should also be an option.

In that case, and in my case, I have a brand new installation that I created a couple of test users to see if the LDAP authentication was working. The tests were inconclusively because the error messages were not logical with a bad password. So I went into the user and user setting table and deleted my account, the only account besides the admin, so I could try again. But alas, for some reason, my account is still hanging around the database somewhere.

So... can someone tell me all of the places in the database I need to purge all instances of a user to get rid of them? I do have a DB interface (webmin) that I can use to swiftly maneuver through the database.

I'll search, then post in another place the issues I'm having with the LDAP authentication.

Thanks,
Tim