Prestashop: Problem with customer account creation

[arg73]

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Screenshots
If applicable, add screenshots or screenrecords to help explain your problem.

Additionnal information
PrestaShop version: N/A
PHP version: N/A

[khouloudbelguith]

Hi @arg73,

Could you please provide us with more info? We need more details to understand how we can reproduce your issue:

• host
• server setup and configuration
• PrestaShop version (source)
• debug mode report
• PHP error logs
• apache error log
• javascript console log
• screenshots

Don't you know how to get this information? Please read the following article:
http://build.prestashop.com/howtos/misc/how-to-create-bug-report/

Thanks!

[arg73]

hello
i have an e-boutic of engraving on glasses ''www.gravure-sur-verres.fr'' with prestashop version 1.6.1.22
since 1 month, eatch day in my back office i have about 20 new creations of customer's accounts
(see the attached picture) which provide from spam, virus or other ...

thanks a lot
thierry

[khouloudbelguith]

@arg73, we need to retrieve the PHP error log and the debug mode report in order to find out what's wrong.
Thanks!

[okom3pom]

@khouloudbelguith

Log and debug are not needed :

https://www.prestashop.com/forums/topic/981159-securite-spam-customer-account-solution-13-17/

https://www.prestashop.com/forums/topic/981158-securite-spam-compte-client-solution-13-17/

The form allows url in fisrtname and lastname.

[okom3pom]

You can also add 1.7 label

[matks]

The form allows url in fisrtname and lastname.

Thank you ! Our understanding of the issue is that the goal of the spam attack is to make the shop send a registration email to a real user, and put there links using firstname or lastname URL. Then the user clicks on the link, be it a spam link or a phishing link.

Did you observe another behavior behind this spam attack ?

[matks]

An additional impact of this behavior: if injected mail addresses are bad and the shop sends registration mail to these addresses, this can damage the mailing reputation of the shop and make it look like a spammer.

This is probably a side-effect of this attack but still annoying

[arg73]

i don't observe another behaviour behind this spam attack
i going to install your solution

thanks for your advices
thierry

[Eolia]

You can also add all versions, since 0.97 ;)

[matks]

PrestaShop versions prior to 1.5 are not maintained anymore, so only 1.6 and 1.7 versions are needed

[arg73]

i have make modification
there is a probleme now
invalid name when i create an account
Customer.txt
Validate.txt
see the 2 files

[eternoendless]

Hi there, we are going to release a patch for 1.7.5.x and 1.6.1.x in order to mitigate the attack vector.