Don't let user register without role/profile2 profile?

Question

I created a site for a client that lets users register an account of either one out of two roles, which then is linked to one of two profile2 types.

Therefore my client wanta no other being able to register without one of these roles/profiles so i did a 301 direct from $site/user/register to in .htacces. It works, as I see it, but somehow users/bots seem to be able to get passed this and register accounts without a role anyway.

Any ideas how to secure this in a better way than currently?

Daniel

Answer 1

Best way to close all ways of creating users without that profile is adding a custom validation function for the user_register form.

In that validate handler just make sure that the form values are right and a user with a profile2 node will be created when form is processed (submit handlers are executed).

Use a form alter to add your validate.

This way you enforce the creation of valid user only where all user creation happen, the the user register form (except admins).