I created a site for a client that lets users register an account of either one out of two roles, which then is linked to one of two profile2 types.

Therefore my client wanta no other being able to register without one of these roles/profiles so i did a 301 direct from $site/user/register to in .htacces. It works, as I see it, but somehow users/bots seem to be able to get passed this and register accounts without a role anyway.

Any ideas how to secure this in a better way than currently?


  • How do you select the profile type for each user? An option in the user register form?
    – sanzante
    Jul 30, 2014 at 16:27
  • The user presses a link of either profile type and there it is a user register form together with thw profile2 form. Jul 31, 2014 at 10:46
  • So if the two forms creates a user with the right profile type the spammers are craeting users using anotbher form? the clean /user/register form?
    – sanzante
    Jul 31, 2014 at 10:48
  • Exactly. And i think i found thw issue: the site is multi lang and you can get pass my 301 by adding a language parameter in the url. Aug 1, 2014 at 10:10

1 Answer 1


Best way to close all ways of creating users without that profile is adding a custom validation function for the user_register form.

In that validate handler just make sure that the form values are right and a user with a profile2 node will be created when form is processed (submit handlers are executed).

Use a form alter to add your validate.

This way you enforce the creation of valid user only where all user creation happen, the the user register form (except admins).

  • Ok, so going with this form alter validate stuff. But I don't understand that part about profile2 node created. How do I check that? Is that like looking for the other hooks that will be following? Sep 16, 2014 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.