Security issue with Reviewer Registration help required urge

[ushasharma84]

We have a security issue regarding Reviewer Registartion. We have enabled the Reviewer Registration Option in Journal Setup as we want to populate reviwer database with more and more potential reviwers .
Now the problem is if anybody knows reviewers Email Id and he enrolles a person using his information and Email-id as Reviwer Then he can access his account as he will be knowing his password. Now can password option be omitted from regsitration and password will be generated randomly which will be available with email as in case of batch import and send me a notification in email should be mandatory. Can it be considered as Feature request or can u give us some pointers on this as we want it to implement as soon as possible.
Thanks in advance

[jmacgreg]

Hi ushasharma84,

Am I right in understanding that you are basically worried about a malicious user impersonating another unregistered possible by registering with their email address? I haven't heard of this happening before, although of course as you point out there's nothing to stop it from happening. I think that a) making it so that a confirmation email is sent out that must be checked as part of the registration process; and b) sending a new user notification email to the journal's primary contact or Journal Manager are two decent feature requests, but I want to make sure I'm understanding the problem correctly before processing them.

Cheers,
James

[ams.jour]

We faced the same problem by malicious user so we closed the reviewer's self registration.

But I also feel that password supply through e-mail is the best option at the time of registration.

-AMS

[ushasharma84]

Hi James
You got it right and according to me generating random password and sending it through Email is right option to prevent malicious users.

[jmacgreg]

Hi all,

Thanks for the feedback! See http://pkp.sfu.ca/bugzilla/show_bug.cgi?id=5877 and http://pkp.sfu.ca/bugzilla/show_bug.cgi?id=5878. Please feel free to CC yourselves to either or both of those reports for future updates.

Cheers,
James

[jaik_70]

Hi
My OJS have User registrartion with CAPTCHA.

Rcecently, I observed that some users register at my OJS with fake email id.

This happen because in present system of OJS give instant access just after the register with athentication of e-mail id.

It will be useful and secure if OJS send first authentical to the new user the allow the access.

-JAIK