User creation issues...

[humantex]

Problem

User creation issues for both frontend and backend.

Technical Details

• Pagekit version: 1.0.17
• Webserver: LiteSpeed
• Database: sqlite 3.26.0
• PHP Version: 7.2.24

These are both issues that have workarounds, which I'll detail, but I wanted to at least document the triggering issues.

1. Adding a new user as the admin from the backend can fail with an incorrect error message describing an unrelated reason...

Steps...
Create any new user while logged in as the admin, where the new user's email address is known to be valid. The only difference with user registrations from a default install is that the 'email-verification' option is enabled, along with admin approval.

Error shown inline is: "Field must be a valid email address." This was a test account, and I created the email address under one of my own domains, have tested it, and it is working and valid.

Workaround...
Create the user with the standard front-facing registration page, and then enable the user once it's created.

I didn't try toggling the registration options to see if there was an alternate setup that would let the backend process complete, but it should work as set, yes?

2. Confirmation email links can be corrupted beyond repair under certain circumstances.

Steps...
When you are logged into the site in a browser that's set up to be your system default - then click on the confirmation email link for a fresh test user - once your confirmation string is sent to a newly opened tab, it will completely fail, and 'corrupt' the new user account - then continue to fail when resubmitting that same URL string. It will consistently fail, no matter what browser is used, and whether your earlier user (or admin) account has been logged out.

Error shown is...
Debug was used, and generated the following:

Workaround...
Delete the new user account (it's toast at this point), and start the registration process again, When done, log out as the other user and click to confirm - or - copy/paste the redone confirmation link into another browser that you aren't logged in with.

Obviously this one isn't an everyday occurrence, but it would have been better to have a graceful failure without destroying/corrupting the data. I presume it destroyed the temporary key issued for the confirmation run somewhere in mid-process, and locked out any possibility to recover from it.