I created a site for a client that lets users register an account of either one out of two roles, which then is linked to one of two profile2 types.

Therefore my client wanta no other being able to register without one of these roles/profiles so i did a 301 direct from $site/user/register to in .htacces. It works, as I see it, but somehow users/bots seem to be able to get passed this and register accounts without a role anyway.

Any ideas how to secure this in a better way than currently?


  • How do you select the profile type for each user? An option in the user register form? – sanzante Jul 30 '14 at 16:27
  • The user presses a link of either profile type and there it is a user register form together with thw profile2 form. – Daniel Holm Jul 31 '14 at 10:46
  • So if the two forms creates a user with the right profile type the spammers are craeting users using anotbher form? the clean /user/register form? – sanzante Jul 31 '14 at 10:48
  • Exactly. And i think i found thw issue: the site is multi lang and you can get pass my 301 by adding a language parameter in the url. – Daniel Holm Aug 1 '14 at 10:10

Best way to close all ways of creating users without that profile is adding a custom validation function for the user_register form.

In that validate handler just make sure that the form values are right and a user with a profile2 node will be created when form is processed (submit handlers are executed).

Use a form alter to add your validate.

This way you enforce the creation of valid user only where all user creation happen, the the user register form (except admins).

| improve this answer | |
  • Ok, so going with this form alter validate stuff. But I don't understand that part about profile2 node created. How do I check that? Is that like looking for the other hooks that will be following? – Daniel Holm Sep 16 '14 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.