Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Restrict Domain Emails uncertain if working properly

  • Participant
    Level: Master
    Posts: 171
    JohnnyNW on February 25, 2020 at 4:13 am #27899

    Hello. I had my list per your requirements: lower case, 1 domain per line.

    gmail.com
    hotmail.com
    outlook.com

    A person registered with an email domain not in the allowed list: protonmail.com

    I’m worried that gmail, hotmail, etc. are being denied while they should be allowed. I put protonmail.com in the list (I didn’t know it even existed). Though I did test outlook, hotmail and gmail and they seem to be working… .

    I dunno – ANY suggestions to alleviate my concerns? Why did protonmail.com create an account when not on list?

    Thank you.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on February 25, 2020 at 10:47 am #27900

    Hi,
    I am sorry for the inconvenience.

    Can you please check if you are using Restrict email domain and not ban email domain plugin?

    https://buddydev.com/plugins/wp-ban-registration-domain/

    We have 2 similar plugin with different purpose and this might be causing the confusion.

    Regards
    Brajesh

  • Participant
    Level: Master
    Posts: 171
    JohnnyNW on February 25, 2020 at 10:56 am #27901

    Hello. I have both plugins.

    WordPress Restrict Email Domains has the list as mentioned earlier.

    WordPress Ban Registration Domain has no list (have it active, in case needed).

    Thank you.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on February 25, 2020 at 10:58 am #27902

    Please disable the “WordPress Ban Registration Domain” and then check. I am assuming that these two plugins do not co-operate.

    Regards
    Brajesh

  • Participant
    Level: Master
    Posts: 171
    JohnnyNW on February 25, 2020 at 11:04 am #27903

    I disabled, but what am I checking?

    My first post on this forum applies:

    “A person registered with an email domain not in the allowed list: protonmail.com

    I’m worried that gmail, hotmail, etc. are being denied while they should be allowed. I put protonmail.com in the list (I didn’t know it even existed). Though I did test outlook, hotmail and gmail and they seem to be working… .

    I dunno – ANY suggestions to alleviate my concerns? Why did protonmail.com create an account when not on list?”

    Thanks.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on February 25, 2020 at 11:06 am #27904

    Hi,
    The user with protonmail was able to register as you had both of these plugin active. It seems to me the Ban registration allowed bypassing the Restrict domains.

    Once you disable the Ban registration, you can try using any other email domain not in your list(say example.com) to verify if the account is restricted from creation or not.

    Regards
    Brajesh

  • Participant
    Level: Master
    Posts: 171
    JohnnyNW on February 25, 2020 at 12:56 pm #27906

    Mmmm with or without Ban Registration, I get expected results (listing allowed only).

    Keeping Ban Registration disabled. I wonder if Stop Spammer plugin messed things up – I have disabled that too.

    Thanks.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on February 26, 2020 at 5:57 pm #27915

    Thank you.
    I am glad it is working again.

    I will check the Stop Spammer to see if it can allow bypassing the restriction. Will post in next couple of days.

    Regards
    Brajesh

  • Participant
    Level: Master
    Posts: 171
    JohnnyNW on March 4, 2020 at 12:57 am #28005

    Restrict Domain Emails: Update: Not working as expected, so I don’t think it’s your other plugin Ban Registration. Someone created an account with rocketmail. Not on my list. Any suggestions? I noticed I have “Restrict Usernames Emails” plugin active – https://wordpress.org/plugins/restrict-usernames-emails-characters/ could that be the problem?

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on March 4, 2020 at 1:37 am #28007

    Hi,
    Please allow me to check the username-emails-characters plugin today. I will get back to you in next 24 hours.

    Any plugin which works with the user registration process may override the email error inadvertently. I will check and confirm.

    Regards
    Brajesh

You must be logged in to reply to this topic.

This topic is: not resolved