|
ningram
|
June 18, 2013 at 12:18 pm
A couple of times recently, we’ve received registrations where there are multiple entries for the form fields. An excerpt from the latest example is pasted below. The data in the second instance of the field in question is correct, but the data in the first instance is junk. Any idea what could be causing this to happen? Most of our registrations come in just fine.
===============================
First Name*: BeergeReick
First Name*: (correct first name, removed for privacy)
Last Name*: BeergeReick
Last Name*: (correct last name, removed for privacy)
Email*: asdgasnstn@gmail.com
Email*: (correct email, removed for privacy)
Address*: http://www.pugster.com
Address*(correct street address, removed for privacy)
===============================
|
|
Josh
|
June 18, 2013 at 7:54 pm
Hi Nathan,
I’m not sure what would cause this to happen. The pugster.com address looks spammy though. Maybe a bot? One thing that may help is to check with the host to see if they can install the Apache modsecurity module.
|
|
ningram
|
June 19, 2013 at 9:04 am
Josh… the Apache modsecurity module is installed on my server already.
Here is a screen shot of the registration in question: http://d.pr/i/qiIy
And this is not the first time it’s happened.
The first field is incorrect but the second field is correct, and it proceeds downward in that way (the registrant’s name is Gloria Henkelman, a customer we know).
If it’s a bot, how are extra fields being created? And if it’s a bot then how is a correct entry being merged with a bot entry?
|
|
Josh
|
June 19, 2013 at 10:01 am
Hi Nathan,
I don’t know the answers to your questions. This isn’t something I’ve seen before. When this happened was it on the current version of Event Espresso or an older one? We’ve added nonce checks to the registration form a few versions back to help harden the registration process.
|
|
ningram
|
June 24, 2013 at 2:41 pm
This issue reoccurred today and has given a little more insight to the problem.
Today, the records combined were from a person who is signing up for an event we are currently taking registrations for and the record of a person who attended an event in October 2012.
Here is a screenshot of today’s entry: http://d.pr/i/FrCR
The first field of each pair is for the person who attended an event last year. The second field of each pair is for the new registrant.
Does this help shed any light on the issue?
|
|
ningram
|
June 24, 2013 at 2:43 pm
Meant to include this in the above… the spam entry in the first example I sent is in our database from a long time ago. So it appears what is happening is that for some reason new entries are merging with old ones. What could be causing this?
|
|
Josh
|
June 24, 2013 at 5:03 pm
This does shed some light on the issue. I could even reproduce it by going in and manually changing the attendee_id values in the wp_events_answer table to match older records. Had any records from wp_events_answer -or- wp_events_attendee been deleted at some point?
|
|
ningram
|
June 26, 2013 at 8:27 am
I was wondering if it could be something like that, IDs getting mismatched or reassigned. I haven’t gone into phpMyAdmin or anything to delete or change any records if that’s what you’re meaning. Is there a way the client could have deleted someone through the WP Admin interface?
|
|
Josh
|
June 26, 2013 at 9:43 am
Attendee records can be deleted through the WP admin interface, but what happens is the records from wp_events_attendee and their corresponding records in wp_events_answer will all be deleted when an attendee record is deleted.
I’m not sure how one could be deleted with the other short of direct db manipulation through something like phpmyadmin. If you can send a db dump of the wp_events_answer and wp_events_attendee tables to support at eventespresso.com we can look into this further.
|
|
Josh
|
June 26, 2013 at 3:36 pm
Hi Nathan,
Thanks for sending these. I looked through and sure enough, there are two sets of attendee data in events_answer that match attendee_ID 129. There is also a duplicate use of attendee_ID 99. And the first attendee_ID entry that used 99 looks kind of spammy. So what I’m thinking is the spam registrations were not recorded correctly to begin with, and they might have been deleted, but the entries in the answers table did not get deleted.
I’m not sure why the original registration that had the attendee_ID 129 was set to use 129. It seems like quite a jump because the first one is in sequence with some other entries that have attendee_IDs in the nineties.
Going forward there shouldn’t be any other entries that would be affected by this discrepancy though because there isn’t any attendee_ID’s higher than 129.
|
