User registration

KeepCoolCH

Hi everyone
Yesterday i created a little user registration file which allows user to register a personal account. This will work with Version 0.12.0. Not best practice or anything, just to inspire you. ;-) The Textoutput is only in German, but it's easy to change in the file.
Feel free to work on it.
Cheers Kevin
download zip

Karl

KeepCoolCH Thanks for this interesting feature 👏

KeepCoolCH

additional info: the file creates a file-folder for each user registred with the username automatically in the specified root folder. you can delete the user or change the settings normally via the built in useradministration in the files.gallery settings.

ABUHUNDI

@Karl this seems a good idea
Can you add this feature in next update where user can register themselves if we have enabled allow user to registered by themselve
If user enters used username while registration it must show username already taken
Also it should be like this I want to create user folders inside a folder for e.g. named "xyz" instead of root directory for each users

I have a school website where I want that students can create an account by themselve and upload their assignment so this feature I seem its interesting

Also from next update can you provide a copy of your documentation website so that we can also add in our website

Karl

ABUHUNDI So basically you want anyone to be able to "Register" and just start uploading? Isn't this a bit insecure, in case it could be a hacker from anywhere in the world? Also, what config options would you assign to each user on registration?

ABUHUNDI Also it should be like this I want to create user folders inside a folder for e.g. named "xyz" instead of root directory for each users

This could work, but I'm not sure a registration system should automatically do this for you.

ABUHUNDI Also from next update can you provide a copy of your documentation website so that we can also add in our website

Copy of what documentation? You mean pages in the below link?
https://www.files.gallery/docs/install/

Why not just link to that website? Besides, why would your users need to see this? It's how to configure Files Gallery on your server with different options and settings. It's not about how to "use" it.

KeepCoolCH

ABUHUNDI the newuser.php file checks if the username is already in use. you can specify the folder in which the user folder should be in the newuser.php file. it don't have to be in the root folder. for myself i located a local folder which don't allow php files and others to be executed. this is the least what you should do to prevent that code is executed from the user in the user folder. maybe someone could enhance the code to built in a email verification to the newuser.php file, that only your students can register. an other possibility is to protect the file with a password only your students could access when you tell your students the registrationpassword. you don't have to link the newuser.php file in the index.php as i did.

ABUHUNDI

Karl in the website I have a teacher panel where I want to show this to admin teachers if they want to make any changes in settings

Karl So basically you want anyone to be able to "Register" and just start uploading? Isn't this a bit insecure, in case it could be a hacker from anywhere in the world? Also, what config options would you assign to each user on registration?

Karl So basically you want anyone to be able to "Register" and just start uploading? Isn't this a bit insecure, in case it could be a hacker from anywhere in the world? Also, what config options would you assign to each user on registration?

Yes I agree with your point, I had not thought about this😅

Karl

ABUHUNDI Yes I agree with your point, I had not thought about this😅

This needs to be planned properly, as it's a bit more complicated, and requires it's own config. Most likely, there would need to be a "registration" page, and then an admin user would need to approve registrations. It might also require downloading an email library (like PHPMailer) to send notification emails to the admin about registrations and to users on activation. It would be an interesting "plugin", but I won't be starting this immediately.

ABUHUNDI I found out that when we switch to desktop mode or to mobile mode, the user gets logged-out

What do you mean "switch to desktop mode or mobile mode"? I have never seen this. As long as the browser keeps all it's cookies, and as long as you don't close the browser window, you will remain logged in.

ABUHUNDI

I found out that when we switch to desktop mode or to mobile mode, the user gets logged-out

Is it normal?

ABUHUNDI

Karl What do you mean "switch to desktop mode or mobile mode"? I have never seen this. As long as the browser keeps all it's cookies, and as long as you don't close the browser window, you will remain logged in.

I have attached a video of the problem
https://jmp.sh/s/1fjMEoPuw8fQJaTn6lIA

As you fan see when I switch to desktop mode or to mobile mode it is asking for logging in again even though the cookies are not cleared

Same issue in your demo

Karl

ABUHUNDI This is likely because the user-agent of the browser changes to simulate a desktop browser (which is basically untrue), and then the encrypted login hash becomes invalid for the current session (which was created for the mobile device user-agent). If you wanted to bypass this, it would affect security. Why would you need to view Files Gallery requested "as desktop website" though? Nobody wants that ...

KeepCoolCH

I played around with the code and integrated the userregistration completely in the index.php (still on version 0.12.0, but i think it will work also with the new versions).

You can toggle the userregistration on or off via the line 'show_user_create_button' => true, in the default config.

When you are on the Login-Site, you can click the link above to get to the userregistration panel. I also implemented alerts which are shown at the same position as the other alerts.

The texts are only in german, but if you like i can create a english version for better understanding.

You can try it out here: Link
admin-user: test
admin-password: test

With a license key you as an admin can delete and edit the users normally via the admin-panel. In the test-link i removed the license key so you won't see my license key. 🙂

You can download the index.php file via this Link

I hope this will help you to implement a full version in an upcoming release. 😉

Karl

KeepCoolCH I did test the link, but I can't see any parts of the user-registration from there of course, since I guess this needs to be enabled first. Yes, I will get back to this post if I look into an official user-registration option. Thanks for your efforts! 👏

KeepCoolCH

I did a little update so the text in the inputfields also changes to let the user now that you should input a new username and password. It‘s very subtile, before only the title changed so i think you didn‘t notice. 😅 Maybe later i can write a little text underneath, then it‘s more noticeble. Perhabs i can add more fields to add an e-mailadress and other information. But for now it‘s only the new username and new password which you have to enter. ☺️

KeepCoolCH

I made a brand new version of the user registration with e-mail verification. The e-mail is sent via the mail()-function in php, so you have to run a mail transfer agent on your server. I use sendmail on my mamp server which you have to specify in the php.ini.

You can try it out here: Link
admin-user: test
admin-password: test

You can download the index.php file via this Link.

The texts are only in german, but if you like i can make a english version.

The name, e-mail and username will be written in the config.php file for each user so you as admin can see the information in the admin-panel.

Karl

KeepCoolCH You can try it out here: Link
admin-user: test
admin-password: test

Still can't see any kinda user registration example from that link ...

KeepCoolCH I made a brand new version of the user registration with e-mail verification. The e-mail is sent via the mail()-function in php, so you have to run a mail transfer agent on your server. I use sendmail on my mamp server which you have to specify in the php.ini.

This will be a challenge for most "normal" users. It might be better to use an external service like Mailjet, Sendgrid or Brevo, which all allow sending at least 100 emails a day for free. In this case, we can just connect directly from PHP.

KeepCoolCH

you have to press the link „>> Einen neuen Benutzer erstellen“ on top to create a user before login. the test user is only to show what happened at the adminpanel after the registration ;-)

Karl

KeepCoolCH you have to press the link „>> Einen neuen Benutzer erstellen“ on top to create a user before login. the test user is only to show what happened at the adminpanel after the registration ;-)

Ahh 😉 It didn't look like a clickable link/button, so I didn't notice. Good job!

The email landed in my Hotmail "spam" folder, another reason why it might be useful to use an external mailer service to send emails. I got this message on clicking the verification link "Keine temporären Daten gefunden. Registrierung evtl. abgelaufen.", but I guess because the expire time is very short?

Users are stored in a database?

KeepCoolCH

Karl after a long search i found out that some email servers are analyzing the verification link with a spam protection or anti virus program. that causes the link to validate itself and when you click on the link it shows the warning, that the temp file is missing. in the new version i did correct that and you have to click the confirm button in the new popup, so that prevents the registration to be activated through the spam protection or anti virus program. normally pretty simple stuff, but first it din't get in my mind, why the temporary json-files were deleted automatically 😉 now it works fine.

test it: Link
download the index.php: Download

KeepCoolCH

as you requested, i changed the mail-function to an external smtp which is written in the secured temp-folder in _files as an .env-file and the folder is automatically secured via .htaccess.

the admin has to change the smtp server, mailadress and password in the .env-file after first start. i implemented a warning, when the settings are the default ones in the .env-file so the admin knows that he has to change the variables.

after this initial installation the userregistration works normally, otherwise the email won't be sent and the warning always shows on top that you have to change the .env-file.

i also set a timer for the email verification to 2 hours, but this can be changed in the index.php file to any time you like.

the userdata is stored in a temporary .json file in the temp-folder and gets deleted, when the 2 hours are over and no verification happened or if the user did the verification.

try it out: Link
to download the new index.php: Download

KeepCoolCH

i did a little correction so the error warning from the unedited .env-file doesn't show up, when the userregistration is turned off in the config line 'show_user_create_button' => false,