RevMax OpenX Payment Plugin Forum

It would seem so to the casual observer, however when viewing what has actually happened in the database, when the form field error checking provided within the RevMax Advertiser signup page is disabled , the user was placed in a pending status.

No users are ever added to a OpenX installation / database until they have created a valid payment using one of the four payment providers gateways  provided within RevMax.

If you ever have such a useless exploit run against the sign up tmp table, and it overwhelms your database storage, you may want to delete some of the extra failed signups.

I would suggest you make sure that the form field error checking is included and used in your forms as to not allow a blank field for a valid sign up and eliminate user input error.

the main issue here is the username that supposedly to be used.  If ever you just inputted something wrong ex. confirmed password, error discount code, etc. ...  and press the submit button. The username will not be available anymore.    ox_signup table will be filled up of unnecessary records.  There is something wrong of the processing of the form.

Again, I would suggest using form field error checking to make sure. Coupon is not a problem. It is checked before username is checked or placed in temporary table. All other fields are echoed back to page if bad coupon, and allowed to submit again.

I am not sure what field isn't being checked for input on your setup, however make sure it is and you wont have the problem. The default with RevMax is wforms.js http://www.formassembly.com/wForms/v2.0/documentation/input-validation.php

If all form fields are submitted correctly the next stop is payment, if payment succeeds the user is placed in the users table and has access to features, if not completed they are still in a pending state. If your organization has enough failed sign ups and your temporary sign up table becomes excessive you can  run a cron job to truncate the table once a day or so.

You had mentioned captcha, and phpcaptcha is easy to integrate also. You can find more information here: http://www.phpcaptcha.org/documentation/quickstart/

Again, this is not any sort of security issue, the user is never placed in a state thet they might gain any benifit other than creating useless records. Again this can be stoped with form field error checking as outlined above. Please check your form.

I am closing this thread.