[#3730] CB Invites - invite code single use only

CB Invites is a great component and I have been testing different security scenarios.

I feel it is vitally important that the invite code issued be checked against the email address and code issued so as a pair they can not be used more than once.

One use case of sending invitations is to build trust in a 'by invitation only' network.

If an invited person joins and then forwards their invitation email to another person, AT PRESENT, the second person CAN use the URL (with used invite code) to register.

Either (a – preferred) the additional attempt(s) should be refused and the user told such before the registration form appears, or (b) the moderator should see that it was a re-use of an invite code so they can reject the registration.

An invite can only be used once. The invite code allows the user to register with an email address other then the one the invite was sent to. It's common for users to go to register and use a separate email address then the one invited. It's working as intended, but if you want to disable invite codes then simply disable the invite_code field and then the only way they can accept the invite is to use the email address at time of registration that the invite was sent to.

Hi and sorry to open this post again but I have the same problem as mstieg.

If an invitation is sent to 4 persons, they all have the same invite code. So, if this code is transferred to another person, he/she can use it.

Morevover, in the database, in thecb_invite table, the last column has the same value for all the invitation despite the emails are differents.

In the backend, it's like all the invitations have been sent to the same person.

Can you help me please?

regards

Myann

Looks like this is happening when multiple email addresses are invited at the same time. Will review and fix for next release as it needs to generate a code unique to each individual invite. As the codes are all the same it caused all invites to be accepted by 1 user.

Ok, thanks!!

Hope the next release will come ASAP because I need it. I'am configure it with my personnal point system to avoid using invitex or parrainvite.

regards

Myann

Simply disable multiple email address via comma separation per invite for now and it'll work fine otherwise. I should have a new release out sometime this week.