Extension:ConfirmAccount

We been getting a lot of user signing up with the intent to do spamming - they haven't been able to because we've had a policy requiring users to request entry into the known group before they can edit. But recently even the number of signups have become annoying and messing up the recent changes, so I've finally installed the ConfirmAccount extension.

It's important to install the version of the extension that matches the MediaWiki version. I find the easiest way to do this is to use Subversion to checkout a specific release of the extension code, e.g.

svn co http://svn.wikimedia.org/svnroot/mediawiki/branches/REL1_16/extensions/ConfirmAccount

This extension also requires some SQL tables to be added. This is easily done by piping the ConfirmAccount.sql into your database from shell. But not that the SQL script will need to be edited in two locations if you use a table-prefix in your wiki.

1.19 issues

After I upgraded the site to 1.19.2, the ConfirmAccount extension broke. I tried updating the code to the latest version with git using:

git clone https://gerrit.wikimedia.org/r/p/mediawiki/extensions/ConfirmAccount.git

but the new SQL would not import correctly giving this error. The solution provided at that link worked, which was to move the definition of the acr_email index to the end after the acr_type_del_reg index definition in the ConfirmAccount.sql file. Note that the account_requests and account_credentials tables had to be dropped before importing the SQL (and since I had outstanding account requests, I had to first export the data and then re-import after creating the tables from the new schema.

But then after that another fatal error occurred when I tried to accept an account registration which was that it tried to insert data into two non-existent columns; acd_xff and acd_agent. I created these columns and then the account could be accepted (but the user had to be deleted with UserMerge first as it had been created during the failed accept preventing it being accepted after the fix was made).

LocalSettings

These are the settings we use for the ConfirmAccount extension on this wiki.

$wgMakeUserPageFromBio = false;
$wgUseRealNamesOnly = false;
$wgAccountRequestMinWords = 0;
$wgAccountRequestToS = false;
$wgAccountRequestExtraInfo = false;
$wgConfirmAccountContact = false;
$wgConfirmAccountCaptchas = false;
$wgAllowAccountRequestFiles = false;
$wgConfirmAccountNotice = true;

System messages

I also adjusted the following system messages to suit our site:

• MediaWiki:Requestaccount-text‎
• MediaWiki:Requestaccount-bio‎
• MediaWiki:Requestaccount-bio-text‎

Adjust code to notify an admin of requests (not required as of MW1.21)

The ConfirmAccount extension does not provide an email notification to administrators when a user requests a new account. There are also no hooks in the user main system allowing an administrator confirmation to be gracefully added, so unfortunately a code-base hack was required to implement this. It has been done by changing line 583 of RequestAccount_body.php which has the following content:

return $user->sendMail(
	wfMsg( 'requestaccount-email-subj' ),
	wfMsg( 'requestaccount-email-body',
		wfGetIP(),
		$user->getName(),
		$url,
		$wgContLang->timeanddate( $expiration, false ),
		$wgContLang->date( $expiration, false ),
		$wgContLang->time( $expiration, false )
	)
);

Insert the following before the return statement to send a message to ad admin first.

User::newFromName( 'ADMIN-USER-NAME' )->sendMail(
        "A new user \"" . $user->getName() . "\" has requested an account on OrganicDesign",
        "A new user \"" . $user->getName() . "\" (" . wfGetIP() . ") has requested an account on OrganicDesign.

Manage account requests at the following link,
https://www.organicdesign.co.nz/Special:ConfirmAccounts"
);