Security

Re: How to send confirmation email to newly registering user via CreateUserWizard

Pedrams — Fri, 30 Jan 2009 22:11:56 GMT

Hi Martin,Thanks For Your Nice Code.I Am Really New In Asp.Net And Have Many Problem.I Have Used Your Code,And I Have Recived Email Via This Code.But That Had No MD5 And Just A ?ID=Cat .

I Don't Know How I Must Activate The Account Via Email.

Please Help Me And Show Me How I Can Do That.

The Behind Code And The ASPX Please.

Wish You The Best

Pedram

Re: How to send confirmation email to newly registering user via CreateUserWizard

butro — Sat, 21 Jul 2007 12:52:10 GMT

I think all these codes must be rewrite, because i couldn't understand and use the codes . It's very complicated. Also very difficult to get all previous posts come together and join. Can somebody rewrite all codes ?

Re: How to send confirmation email to newly registering user via CreateUserWizard

Mattw67 — Thu, 11 Jan 2007 04:15:45 GMT

Here is my working code to have the User Key instead of the User Name (i have only modified these 2 files and it works, there are also some other changes for roles that i've add) :

--------------------------------------
"CreateAccount.aspx.vb"
--------------------------------------
Partial Class CreateAccount
    Inherits System.Web.UI.Page
    Protected Sub CreateUserWizard1_CreatedUser(ByVal sender As Object, ByVal e As System.EventArgs) Handles CreateUserWizard1.CreatedUser
        ' Set Account to IsApproved=False
        Dim Usr As MembershipUser = Membership.GetUser(Me.CreateUserWizard1.UserName, True)
        Dim roleName As String
        Dim UserName As String
        UserName = Me.CreateUserWizard1.UserName
        roleName = "users"
        Usr.IsApproved = False
        Membership.UpdateUser(Usr)
        ' Add User to "Users" role
        Roles.AddUserToRole(UserName, roleName)
    End Sub

    Protected Sub Createuserwizard1_SendingMail(ByVal sender As Object, ByVal e As MailMessageEventArgs)
        Dim Usr As MembershipUser = Membership.GetUser(Me.CreateUserWizard1.UserName, True)
        Dim UserId As String
        UserId = Usr.ProviderUserKey.ToString()
        ' Set MailMessage fields.
        e.Message.IsBodyHtml = True
        e.Message.Subject = "Welcome to blablabla.com"
        ' See Createuserwizard1.maildefinition.bodyfilename to find CreateAccountMailfile.txt
        ' Replace placeholder text in message body with information provided by the user.
        '         e.Message.Body = e.Message.Body.Replace("<%PasswordAnswer%>", CreateUserWizard1.Answer)
        e.Message.Body = e.Message.Body.Replace("<%DomainName%>", Request.ServerVariables("SERVER_NAME"))
        e.Message.Body = e.Message.Body.Replace("<%VirtualDirectory%>", Request.ApplicationPath)
        e.Message.Body = e.Message.Body.Replace("<%UserLogsOnAs%>", UserId)
    End Sub
End Class

--------------------------------------
"activate.aspx.vb"
--------------------------------------
Partial Class activate
    Inherits System.Web.UI.Page

    Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
        'Dim ticketNumber = Request.QueryString("USERID")
        'TextBox1.Text = ticketNumber
        If Not Page.IsPostBack Then
            Dim UserName As String = Request.Params("USERID")
            Dim providerUserKey As Guid = New Guid(UserName)
            If Not String.IsNullOrEmpty(UserName) Then
                Dim usr As MembershipUser = Membership.GetUser(providerUserKey)
                If Not Nothing Is usr Then
                    usr.IsApproved = True
                    Membership.UpdateUser(usr)
                End If
                Response.Redirect("default.aspx")
            End If
        Else
            Response.Redirect("default2.aspx.aspx")
        End If
    End Sub
End Class

Re: How to send confirmation email to newly registering user via CreateUserWizard

Candunn — Tue, 09 Jan 2007 20:32:09 GMT

You can try

e.Message.Body = e.Message.Body.Replace("<%activatecode%>", Membership.GetUser.ProviderUserKey.ToString())

I had a problem with this though as sometimes it would work and others it wouldn't if anyone could shed some light as to why it would be ever so clever.

I imagine that the email is sent sometimes before the user actually has a guid, and other time because of email delays? the gui is created and then it can send it.

Re: How to send confirmation email to newly registering user via CreateUserWizard

Niall20 — Thu, 04 Jan 2007 10:41:07 GMT

Any chance of a C# version? Thanks for everyones help.

Re: How to send confirmation email to newly registering user via CreateUserWizard

Mattw67 — Thu, 04 Jan 2007 01:08:09 GMT

Works great!!!

Kool.

Now we have to find how to use the UserId instead of the UserName in the confirmation email...

Someone have an idea?

Re: How to send confirmation email to newly registering user via CreateUserWizard

Candunn — Wed, 20 Dec 2006 20:11:56 GMT

Ok I got it working, but is it secure I don't know here we go:

I added it to the club starter kit.

@ Page Language="VB" MasterPageFile="~/Default.master" Title="New Member Registration" %>

@ Register Src="Photos_formpicker.ascx" TagName="Photos_formpicker" TagPrefix="Club" %>

@ Register TagPrefix="Club" Namespace="ClubSite" %>

script runat="server">

'Partial Class CreateAccount

Protected Sub CreateUserFinished(ByVal sender As Object, ByVal e As System.Web.UI.WebControls.WizardNavigationEventArgs)

Try

Dim null As New Nullable(Of Integer)

Dim da As New DataSetTableAdapters.MemberInfoTableAdapter

Dim user As MembershipUser = Membership.GetUser(CreateUserWizard1.UserName)

da.Insert(

CType(user.ProviderUserKey, Guid), Addr.Text, Phone.Text, fname.Text, lname.Text, UnitNo.text)

user.IsApproved =

False

Membership.UpdateUser(user)

FormsAuthentication.SetAuthCookie(CreateUserWizard1.UserName,

False)

'Response.Redirect("default.aspx")

Catch ex As Exception

'Membership.DeleteUser(UserName.Text)

'ErrorMessage.Text = "Could not create user record: " & ex.Message

End Try

End Sub

Protected Sub Createuserwizard1_SendingMail(ByVal sender As Object, ByVal e As MailMessageEventArgs)

' Set MailMessage fields.

e.Message.IsBodyHtml =

False

e.Message.Subject =

"Welcome to XYZ"

' See Createuserwizard1.maildefinition.bodyfilename to find CreateAccountMailfile.txt

' Replace placeholder text in message body with information provided by the user.

' http://<%DomainName%><%VirtualDirectory%>/Default.aspx?ID=<%UserLogsOnAs%>

e.Message.Body = e.Message.Body.Replace(

"<%PasswordQuestion%>", CreateUserWizard1.Question)

e.Message.Body = e.Message.Body.Replace(

"<%PasswordAnswer%>", CreateUserWizard1.Answer)

e.Message.Body = e.Message.Body.Replace(

"<%DomainName%>", Request.ServerVariables("SERVER_NAME"))

e.Message.Body = e.Message.Body.Replace(

"<%VirtualDirectory%>", Request.ApplicationPath)

e.Message.Body = e.Message.Body.Replace(

"<%UserLogsOnAs%>", CreateUserWizard1.UserName)

'e.Message.Body = e.Message.Body.Replace("<%activatecode%>", Membership.GetUser.ProviderUserKey.ToString())

End Sub

'End Class

script>

asp:Content ID="Content2" ContentPlaceHolderID="ContentPlaceHolder1" runat="Server">

<h2>

New Member Registration

</h2>

<p>

Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh

euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad

minim veniam, quis nostrud exercitation ulliam corper suscipit lobortis nisl ut

aliquip ex ea commodo consequat. Duis autem veleum iriure dolor in hendrerit in

vulputate velit esse molestie consequat, vel willum lunombro dolore eu feugiat nulla

facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent

luptatum zzril delenit augue duis dolore te feugait nulla facilisi.

</p>

</div>

<h2>

New user registration

</h2>

</div>

<asp:CreateUserWizard ID="CreateUserWizard1" runat="server" DisableCreatedUser="True"

OnFinishButtonClick="CreateUserFinished"

FinishDestinationPageUrl="activate.aspx"

onsendingmail="Createuserwizard1_SendingMail"

MailDefinition-BodyFileName="CreateAccountMailfile.txt">

<asp:CreateUserWizardStep runat="server">

User Name:

<asp:TextBox ID="UserName" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="UserNameRequired" runat="server" ControlToValidate="UserName"

ErrorMessage="User Name is required." ToolTip="User Name is required." ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

Password:

<asp:TextBox ID="Password" runat="server" TextMode="Password"></asp:TextBox>

<asp:RequiredFieldValidator ID="PasswordRequired" runat="server" ControlToValidate="Password"

ErrorMessage="Password is required." ToolTip="Password is required." ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

Confirm Password:

<asp:TextBox ID="ConfirmPassword" runat="server" TextMode="Password"></asp:TextBox>

<asp:RequiredFieldValidator ID="ConfirmPasswordRequired" runat="server" ControlToValidate="ConfirmPassword"

ErrorMessage="Confirm Password is required." ToolTip="Confirm Password is required."

ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

E-mail:

<asp:TextBox ID="Email" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="EmailRequired" runat="server" ControlToValidate="Email"

ErrorMessage="E-mail is required." ToolTip="E-mail is required." ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

Security Question:

<asp:TextBox ID="Question" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="QuestionRequired" runat="server" ControlToValidate="Question"

ErrorMessage="Security question is required." ToolTip="Security question is required."

ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

Security Answer:

<asp:TextBox ID="Answer" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="AnswerRequired" runat="server" ControlToValidate="Answer"

ErrorMessage="Security answer is required." ToolTip="Security answer is required."

ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

<asp:CompareValidator ID="PasswordCompare" runat="server" ControlToCompare="Password"

ControlToValidate="ConfirmPassword" Display="Dynamic" ErrorMessage="The Password and Confirmation Password must match."

ValidationGroup="CreateUserWizard1"></asp:CompareValidator>

</td>

</tr>

<tr>

<asp:Literal ID="ErrorMessage" runat="server" EnableViewState="False"></asp:Literal>

<Club:RolloverButton ID="cu" runat="server" CommandName="MoveNext" Text="Create User" />

</CustomNavigationTemplate>

</asp:CreateUserWizardStep>

<asp:WizardStep runat="server" Title="Contact details">

First Name:

<asp:TextBox runat="server" ID="fname" CssClass="txtfield" />

<asp:RequiredFieldValidator ControlToValidate="fname" ErrorMessage="First Name is required."

ID="RequiredFieldValidator1" runat="server" ToolTip="First Name is required."

ValidationGroup="CreateUserForm">*</asp:RequiredFieldValidator>

Last Name:

<asp:TextBox runat="server" ID="lname" CssClass="txtfield" />

<asp:RequiredFieldValidator ControlToValidate="lname" ErrorMessage="Last Name is required."

ID="RequiredFieldValidator2" runat="server" ToolTip="Last Name is required."

ValidationGroup="CreateUserForm">*</asp:RequiredFieldValidator>

Address:

<asp:TextBox runat="server" ID="Addr" Rows="3" TextMode="MultiLine" CssClass="txtblock" />

Phone:

<asp:TextBox runat="server" ID="Phone" CssClass="txtfield" />

</td>

</tr>

<tr>

td class="formlabel">

label for="UnitNo">

UnitNo:

</label>

td>

td class="formvalue">

asp:TextBox runat="server" ID="UnitNo" CssClass="txtfield" />

<asp:CompleteWizardStep runat="server">

<p>

Your account has been successfully created.

</p>

<Club:RolloverButton ID="ContinueButton" runat="server" CommandName="Continue"

Text="Continue" />

</ContentTemplate>

</asp:CompleteWizardStep>

</WizardSteps>

<Club:RolloverButton ID="StepPreviousButton" runat="server" CausesValidation="False"

CommandName="MovePrevious" Text="Previous" />

<Club:RolloverButton ID="StepNextButton" runat="server" CommandName="MoveNext"

Text="Next" />

</StepNavigationTemplate>

</asp:CreateUserWizard>

</div>

</div>

asp:Content>

Then you need the email text body called "CreateAccountMailfile.txt"

Your account was set up on our site with the following:

Username: <%UserName%>

To reset your password, you must answer the following question you established:

Password Question: <%PasswordQuestion%>

Password Answer: <%PasswordAnswer%>

Please complete your registration by clicking on the following link which will serve to validate your

email address and give you an opportunity to complete your Profile information which we require:

MasterPageFile="~/Default.master" AutoEventWireup="false" CodeFile="activate.aspx.vb" Inherits="activate" title="Untitled Page" %>

asp:Content ID="Content1" ContentPlaceHolderID="ContentPlaceHolder1" Runat="Server">

<asp:TextBox ID="TextBox1" runat="server"></asp:TextBox>

asp:Content>

and the code behind file ativate.aspx.vb

Partial

Class activate

Inherits System.Web.UI.Page

Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load

'Dim ticketNumber = Request.QueryString("USERID")

'TextBox1.Text = ticketNumber

If Not Page.IsPostBack Then

Dim UserName As String = Request.Params("USERID")

If Not String.IsNullOrEmpty(UserName) Then

Dim usr As MembershipUser = Membership.GetUser(UserName, True)

If Not Nothing Is usr Then

usr.IsApproved =

True

Membership.UpdateUser(usr)

Response.Redirect(

Response.Redirect(

End

Thats it let me know how it works for you

Re: How to send confirmation email to newly registering user via CreateUserWizard

Candunn — Mon, 18 Dec 2006 04:47:00 GMT

Yes!!!! can some one help us please

Re: How to send confirmation email to newly registering user via CreateUserWizard

Mattw67 — Sat, 16 Dec 2006 19:20:33 GMT

Hi guys!

Can you please provide a "working" complete code of this cause i tried what you said and nothing works (the only thing that work is the sending mail).

Please provide every pages (and code) that is needed for a working solution.

You gave me just some parts and it doesn't work.

Please understand that i have not your skills guys... Im new to programming and ASP.net

Thanks

Re: How to send confirmation email to newly registering user via CreateUserWizard

mokeefe — Fri, 15 Dec 2006 04:13:35 GMT

Hi Niall and all,

If the Account confirmation page is http://www.mydomain.com/activateaccount.aspx?username=username

Then once a user has created an account successfully, it is conceivable that they could then create accounts programmatically confirmed and authorised (they would know the URL).

This therefore indicates the need for provisioning of some level of security in the URL. The following example is only an initial rough example for this provisioning and mitigation against the above scenario.

This code is a first run, with no plan and no doubt could be re-factored and its implementation reviewed. It is only provided for an example to illustrate my earlier post. The most obvious is that if an account is disabled, and is meant to stay that way, this link could be used to re-enable it. That’s where it would need timestamps.

Sample provides MD5 hash of Username (not in URL), ProviderKey and AccountValidation Class defined Salt. This can then be validated in the activateAccount.aspx page or even in the login page or any other page of your choosing.

Generates URL Params for appending to email link –

p=b32859ee-8ab7-4472-b6dc-4bc9cfb4dc3d&sc=9641717D7438505D065255C2C58F1F29

Code Behind For Sample ASPX (there is no designer items).

Protected Sub Page_Init(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Init

' Get the user - ypu might do this with wizard related inputs (username etc.

Dim usr As MembershipUser = Membership.GetUser("cjweb")

' For SQLMembershipProvider

' Provide MembershipUser - this is the only input value

Dim AccountVal As New AccountValidation()

Dim EmailParams As String = AccountVal.GetAccountValidationParams(usr)

' Temporary - will write Page Params to page

Response.Write(String.Format("Email Params:{0}<br/>", EmailParams))

' -------------------------------

' Account Validation

' If Third argument (DefaultRedir) is True and the user is validated, the user will be automatically authenticated and redirected to the DefaultUrL as defined for Forms Authentication

' This line is all that would be required for a default redirect, and could be provided at the top of the actual Login page logic - where that page was the link in the email.

' using alternate instance variable name so as not to conflict with test on single page.

Dim AccountValidator As New AccountValidation(Me, True, False)

' Optional - Using the IsValid property for in page logic, possiubly adding forms cookie, providing confirmation, and a time redirect.

If AccountValidator.IsValid Then

Response.Write(String.Format("Account is validated:{0}", AccountValidator.IsValid.ToString()))

Else

' just the same for sample

Response.Write(String.Format("Account is validated:{0}", AccountValidator.IsValid.ToString()))

End If

' End account Validation

' -------------------------------

' Temporary - Provided for sample and testing

Dim lnk As New HyperLink

lnk.NavigateUrl = Me.Request.Url.LocalPath & "?" & EmailParams

lnk.Text = "Request Page with Params"

Me.form1.Controls.Add(lnk)

End Sub

Global Class in App_code Directory (“AccountValidation.vb”)

Imports Microsoft.VisualBasic

Public Class AccountValidation

Dim ValidationCode As String = Nothing

Dim ProviderKey As Guid = Nothing

Dim User As MembershipUser = Nothing

Private Salt As String = "SomeUniqueValue" ' set this for it to be unique for your site!

Private _IsValid As Boolean = False

Public ReadOnly Property IsValid() As Boolean

Get

Return Me._IsValid

End Get

End Property

Public Function GetAccountValidationParams(ByVal Usr As MembershipUser) As String

If Usr Is Nothing Then

Throw New Exception("User cannot be null or nothing")

End If

' these params are parsed in one of the constructor overloads

Return "p=" & Usr.ProviderUserKey.ToString() & "&sc=" & Me.GetValidationcode(Usr.ProviderUserKey, Usr.UserName)

End Function

Private Function ValidateAccount(ByVal ProviderKey As Guid, ByVal SecurityCode As Object) As Boolean

Me.User = Me.GetUser(ProviderKey)

If Nothing Is Me.User Then

Return False

End If

If Me.GetValidationcode(ProviderKey, Me.User.UserName) = ValidationCode Then

Return True

Else

Return False

End If

End Function

Private Function GetUser(ByVal Key As Guid) As MembershipUser

Me.User = Membership.GetUser(Key)

Return Me.User

End Function

Private Function GetValidationcode(ByVal ProviderKey As Guid, ByVal UserName As String) As String

Dim FullString As String = ProviderKey.ToString() & UserName & Salt ' using a fixed salt and the username, essentially makes the salt unique and unknown

Dim bytes As Byte() = Text.Encoding.Unicode.GetBytes(FullString)

bytes = New System.Security.Cryptography.MD5CryptoServiceProvider().ComputeHash(bytes)

Return ByteArrayToString(bytes)

End Function

Private Function ByteArrayToString(ByVal Input() As Byte) As String

Dim i As Integer

Dim sOutput As New StringBuilder(Input.Length)

For i = 0 To Input.Length - 1

sOutput.Append(Input(i).ToString("X2"))

Return sOutput.ToString()

End Function

Public Sub New(ByRef CurrentPage As UI.Page, ByVal EnableAccount As Boolean, ByVal DefaultRedir As Boolean)

MyBase.New()

Me.ValidationCode = CurrentPage.Request.Params("sc")

Dim GUIDString As String = CurrentPage.Request.Params("p")

If Not String.IsNullOrEmpty(GUIDString) AndAlso Not Nothing Is Me.ValidationCode Then

Try

Me.ProviderKey = New Guid(CurrentPage.Request.Params("p"))

Me._IsValid = Me.ValidateAccount(Me.ProviderKey, Me.ValidationCode)

If EnableAccount Then

Me.User.IsApproved = True

Membership.UpdateUser(Me.User)

End If

If Me._IsValid And DefaultRedir Then ' does optional redirection

FormsAuthentication.RedirectFromLoginPage(Me.User.UserName, False)

End If

Catch

End Try

End If

End Sub

Public Sub New()

MyBase.New()

End Sub

End Class

Now are we on the same hymn sheet?

Regards,

Martin.

Re: How to send confirmation email to newly registering user via CreateUserWizard

Candunn — Wed, 13 Dec 2006 18:30:32 GMT

Hi Guys,

I am trying to implement this with the club starter kit, I followed the code posted above an am able to generate the email on the creatuserwizard, but I am totally lost on how to build the activate page so it will set userisapproved from the query string. This is what I have so far:

@ Page Language="VB" MasterPageFile="~/Default.master" Title="New Member Registration" %>

@ Register Src="Photos_formpicker.ascx" TagName="Photos_formpicker" TagPrefix="Club" %>

@ Register TagPrefix="Club" Namespace="ClubSite" %>

script runat="server">

'Partial Class CreateAccount

Protected Sub CreateUserFinished(ByVal sender As Object, ByVal e As System.Web.UI.WebControls.WizardNavigationEventArgs)

Try

Dim null As New Nullable(Of Integer)

Dim da As New DataSetTableAdapters.MemberInfoTableAdapter

Dim user As MembershipUser = Membership.GetUser(CreateUserWizard1.UserName)

da.Insert(

CType(user.ProviderUserKey, Guid), Addr.Text, Phone.Text, fname.Text, lname.Text, UnitNo.text)

user.IsApproved =

False

Membership.UpdateUser(user)

FormsAuthentication.SetAuthCookie(CreateUserWizard1.UserName,

False)

'Response.Redirect("default.aspx")

Catch ex As Exception

'Membership.DeleteUser(UserName.Text)

'ErrorMessage.Text = "Could not create user record: " & ex.Message

End Try

End Sub

Protected Sub Createuserwizard1_SendingMail(ByVal sender As Object, ByVal e As MailMessageEventArgs)

' Set MailMessage fields.

e.Message.IsBodyHtml =

False

e.Message.Subject =

"Welcome to Poker in Bermuda"

' See Createuserwizard1.maildefinition.bodyfilename to find CreateAccountMailfile.txt

' Replace placeholder text in message body with information provided by the user.

' http://<%DomainName%><%VirtualDirectory%>/Default.aspx?ID=<%UserLogsOnAs%>

e.Message.Body = e.Message.Body.Replace(

"<%PasswordQuestion%>", CreateUserWizard1.Question)

e.Message.Body = e.Message.Body.Replace(

"<%PasswordAnswer%>", CreateUserWizard1.Answer)

e.Message.Body = e.Message.Body.Replace(

"<%DomainName%>", Request.ServerVariables("SERVER_NAME"))

e.Message.Body = e.Message.Body.Replace(

"<%VirtualDirectory%>", Request.ApplicationPath)

e.Message.Body = e.Message.Body.Replace(

"<%UserLogsOnAs%>", CreateUserWizard1.UserName)

e.Message.Body = e.Message.Body.Replace(

"<%activatecode%>", Membership.GetUser.ProviderUserKey.ToString())

End Sub

'End Class

script>

asp:Content ID="Content2" ContentPlaceHolderID="ContentPlaceHolder1" runat="Server">

<h2>

New Member Registration

</h2>

<p>

Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh

euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad

minim veniam, quis nostrud exercitation ulliam corper suscipit lobortis nisl ut

aliquip ex ea commodo consequat. Duis autem veleum iriure dolor in hendrerit in

vulputate velit esse molestie consequat, vel willum lunombro dolore eu feugiat nulla

facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent

luptatum zzril delenit augue duis dolore te feugait nulla facilisi.

</p>

</div>

<h2>

New user registration

</h2>

</div>

<asp:CreateUserWizard ID="CreateUserWizard1" runat="server" DisableCreatedUser="True"

OnFinishButtonClick="CreateUserFinished"

FinishDestinationPageUrl="Default.aspx"

onsendingmail="Createuserwizard1_SendingMail"

MailDefinition-bodyfilename="CreateAccountMailfile.txt"

MailDefinition-from="noreply@your_emailserver.com">

<asp:CreateUserWizardStep runat="server">

<p>

</p>

<tr>

User Name:

</label></td>

<td>

<asp:TextBox ID="UserName" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="UserNameRequired" runat="server" ControlToValidate="UserName"

ErrorMessage="User Name is required." ToolTip="User Name is required." ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

Password:

</label></td>

<td>

<asp:TextBox ID="Password" runat="server" TextMode="Password"></asp:TextBox>

<asp:RequiredFieldValidator ID="PasswordRequired" runat="server" ControlToValidate="Password"

ErrorMessage="Password is required." ToolTip="Password is required." ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

Confirm Password:

</label></td>

<td>

<asp:TextBox ID="ConfirmPassword" runat="server" TextMode="Password"></asp:TextBox>

<asp:RequiredFieldValidator ID="ConfirmPasswordRequired" runat="server" ControlToValidate="ConfirmPassword"

ErrorMessage="Confirm Password is required." ToolTip="Confirm Password is required."

ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

E-mail:

</label></td>

<td>

<asp:TextBox ID="Email" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="EmailRequired" runat="server" ControlToValidate="Email"

ErrorMessage="E-mail is required." ToolTip="E-mail is required." ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

Security Question:

</label></td>

<td>

<asp:TextBox ID="Question" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="QuestionRequired" runat="server" ControlToValidate="Question"

ErrorMessage="Security question is required." ToolTip="Security question is required."

ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

Security Answer:

</label></td>

<td>

<asp:TextBox ID="Answer" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="AnswerRequired" runat="server" ControlToValidate="Answer"

ErrorMessage="Security answer is required." ToolTip="Security answer is required."

ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

<asp:CompareValidator ID="PasswordCompare" runat="server" ControlToCompare="Password"

ControlToValidate="ConfirmPassword" Display="Dynamic" ErrorMessage="The Password and Confirmation Password must match."

ValidationGroup="CreateUserWizard1"></asp:CompareValidator>

</td>

</tr>

<tr>

<asp:Literal ID="ErrorMessage" runat="server" EnableViewState="False"></asp:Literal>

</td>

</tr>

</table>

</ContentTemplate>

<Club:RolloverButton ID="cu" runat="server" CommandName="MoveNext" Text="Create User" />

</CustomNavigationTemplate>

</asp:CreateUserWizardStep>

<asp:WizardStep runat="server" Title="Contact details">

<table>

<tr>

First Name:

</label>

</td>

<asp:TextBox runat="server" ID="fname" CssClass="txtfield" />

<asp:RequiredFieldValidator ControlToValidate="fname" ErrorMessage="First Name is required."

ID="RequiredFieldValidator1" runat="server" ToolTip="First Name is required."

ValidationGroup="CreateUserForm">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

Last Name:

</label>

</td>

<asp:TextBox runat="server" ID="lname" CssClass="txtfield" />

<asp:RequiredFieldValidator ControlToValidate="lname" ErrorMessage="Last Name is required."

ID="RequiredFieldValidator2" runat="server" ToolTip="Last Name is required."

ValidationGroup="CreateUserForm">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

Address:

</label>

</td>

<asp:TextBox runat="server" ID="Addr" Rows="3" TextMode="MultiLine" CssClass="txtblock" />

</td>

</tr>

<tr>

Phone:

</label>

</td>

<asp:TextBox runat="server" ID="Phone" CssClass="txtfield" />

</td>

</tr>

<tr>

td class="formlabel">

label for="UnitNo">

UnitNo:

</label>

td>

td class="formvalue">

asp:TextBox runat="server" ID="UnitNo" CssClass="txtfield" />

td>

tr>

</table>

</asp:WizardStep>

<asp:CompleteWizardStep runat="server">

<p>

Your account has been successfully created.

</p>

<Club:RolloverButton ID="ContinueButton" runat="server" CommandName="Continue"

Text="Continue" />

</ContentTemplate>

</asp:CompleteWizardStep>

</WizardSteps>

<Club:RolloverButton ID="StepPreviousButton" runat="server" CausesValidation="False"

CommandName="MovePrevious" Text="Previous" />

<Club:RolloverButton ID="StepNextButton" runat="server" CommandName="MoveNext"

Text="Next" />

</StepNavigationTemplate>

</asp:CreateUserWizard>

</div>

</div>

asp:Content>

Can anyone provide an example of a page (code) that will activate the user when they click on the link.

Also I want to use the userid

Membership.GetUser.ProviderUserKey.ToString() but I think the email is sent before the user is created so it bombs out.

Any help will be greatly apreciated.

Re: How to send confirmation email to newly registering user via CreateUserWizard

Candunn — Wed, 13 Dec 2006 18:30:26 GMT

Hi Guys,

@ Page Language="VB" MasterPageFile="~/Default.master" Title="New Member Registration" %>

@ Register Src="Photos_formpicker.ascx" TagName="Photos_formpicker" TagPrefix="Club" %>

@ Register TagPrefix="Club" Namespace="ClubSite" %>

script runat="server">

'Partial Class CreateAccount

Protected Sub CreateUserFinished(ByVal sender As Object, ByVal e As System.Web.UI.WebControls.WizardNavigationEventArgs)

Try

Dim null As New Nullable(Of Integer)

Dim da As New DataSetTableAdapters.MemberInfoTableAdapter

Dim user As MembershipUser = Membership.GetUser(CreateUserWizard1.UserName)

da.Insert(

CType(user.ProviderUserKey, Guid), Addr.Text, Phone.Text, fname.Text, lname.Text, UnitNo.text)

user.IsApproved =

False

Membership.UpdateUser(user)

FormsAuthentication.SetAuthCookie(CreateUserWizard1.UserName,

False)

'Response.Redirect("default.aspx")

Catch ex As Exception

'Membership.DeleteUser(UserName.Text)

'ErrorMessage.Text = "Could not create user record: " & ex.Message

End Try

End Sub

Protected Sub Createuserwizard1_SendingMail(ByVal sender As Object, ByVal e As MailMessageEventArgs)

' Set MailMessage fields.

e.Message.IsBodyHtml =

False

e.Message.Subject =

"Welcome to Poker in Bermuda"

' See Createuserwizard1.maildefinition.bodyfilename to find CreateAccountMailfile.txt

' Replace placeholder text in message body with information provided by the user.

' http://<%DomainName%><%VirtualDirectory%>/Default.aspx?ID=<%UserLogsOnAs%>

e.Message.Body = e.Message.Body.Replace(

"<%PasswordQuestion%>", CreateUserWizard1.Question)

e.Message.Body = e.Message.Body.Replace(

"<%PasswordAnswer%>", CreateUserWizard1.Answer)

e.Message.Body = e.Message.Body.Replace(

"<%DomainName%>", Request.ServerVariables("SERVER_NAME"))

e.Message.Body = e.Message.Body.Replace(

"<%VirtualDirectory%>", Request.ApplicationPath)

e.Message.Body = e.Message.Body.Replace(

"<%UserLogsOnAs%>", CreateUserWizard1.UserName)

e.Message.Body = e.Message.Body.Replace(

"<%activatecode%>", Membership.GetUser.ProviderUserKey.ToString())

End Sub

'End Class

script>

asp:Content ID="Content2" ContentPlaceHolderID="ContentPlaceHolder1" runat="Server">

<h2>

New Member Registration

</h2>

<p>

Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh

euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad

minim veniam, quis nostrud exercitation ulliam corper suscipit lobortis nisl ut

aliquip ex ea commodo consequat. Duis autem veleum iriure dolor in hendrerit in

vulputate velit esse molestie consequat, vel willum lunombro dolore eu feugiat nulla

facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent

luptatum zzril delenit augue duis dolore te feugait nulla facilisi.

</p>

</div>

<h2>

New user registration

</h2>

</div>

<asp:CreateUserWizard ID="CreateUserWizard1" runat="server" DisableCreatedUser="True"

OnFinishButtonClick="CreateUserFinished"

FinishDestinationPageUrl="Default.aspx"

onsendingmail="Createuserwizard1_SendingMail"

MailDefinition-bodyfilename="CreateAccountMailfile.txt"

MailDefinition-from="noreply@your_emailserver.com">

<asp:CreateUserWizardStep runat="server">

<p>

</p>

<tr>

User Name:

</label></td>

<td>

<asp:TextBox ID="UserName" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="UserNameRequired" runat="server" ControlToValidate="UserName"

ErrorMessage="User Name is required." ToolTip="User Name is required." ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

Password:

</label></td>

<td>

<asp:TextBox ID="Password" runat="server" TextMode="Password"></asp:TextBox>

<asp:RequiredFieldValidator ID="PasswordRequired" runat="server" ControlToValidate="Password"

ErrorMessage="Password is required." ToolTip="Password is required." ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

Confirm Password:

</label></td>

<td>

<asp:TextBox ID="ConfirmPassword" runat="server" TextMode="Password"></asp:TextBox>

<asp:RequiredFieldValidator ID="ConfirmPasswordRequired" runat="server" ControlToValidate="ConfirmPassword"

ErrorMessage="Confirm Password is required." ToolTip="Confirm Password is required."

ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

E-mail:

</label></td>

<td>

<asp:TextBox ID="Email" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="EmailRequired" runat="server" ControlToValidate="Email"

ErrorMessage="E-mail is required." ToolTip="E-mail is required." ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

Security Question:

</label></td>

<td>

<asp:TextBox ID="Question" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="QuestionRequired" runat="server" ControlToValidate="Question"

ErrorMessage="Security question is required." ToolTip="Security question is required."

ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

Security Answer:

</label></td>

<td>

<asp:TextBox ID="Answer" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="AnswerRequired" runat="server" ControlToValidate="Answer"

ErrorMessage="Security answer is required." ToolTip="Security answer is required."

ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

<asp:CompareValidator ID="PasswordCompare" runat="server" ControlToCompare="Password"

ControlToValidate="ConfirmPassword" Display="Dynamic" ErrorMessage="The Password and Confirmation Password must match."

ValidationGroup="CreateUserWizard1"></asp:CompareValidator>

</td>

</tr>

<tr>

<asp:Literal ID="ErrorMessage" runat="server" EnableViewState="False"></asp:Literal>

</td>

</tr>

</table>

</ContentTemplate>

<Club:RolloverButton ID="cu" runat="server" CommandName="MoveNext" Text="Create User" />

</CustomNavigationTemplate>

</asp:CreateUserWizardStep>

<asp:WizardStep runat="server" Title="Contact details">

<table>

<tr>

First Name:

</label>

</td>

<asp:TextBox runat="server" ID="fname" CssClass="txtfield" />

<asp:RequiredFieldValidator ControlToValidate="fname" ErrorMessage="First Name is required."

ID="RequiredFieldValidator1" runat="server" ToolTip="First Name is required."

ValidationGroup="CreateUserForm">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

Last Name:

</label>

</td>

<asp:TextBox runat="server" ID="lname" CssClass="txtfield" />

<asp:RequiredFieldValidator ControlToValidate="lname" ErrorMessage="Last Name is required."

ID="RequiredFieldValidator2" runat="server" ToolTip="Last Name is required."

ValidationGroup="CreateUserForm">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

Address:

</label>

</td>

<asp:TextBox runat="server" ID="Addr" Rows="3" TextMode="MultiLine" CssClass="txtblock" />

</td>

</tr>

<tr>

Phone:

</label>

</td>

<asp:TextBox runat="server" ID="Phone" CssClass="txtfield" />

</td>

</tr>

<tr>

td class="formlabel">

label for="UnitNo">

UnitNo:

</label>

td>

td class="formvalue">

asp:TextBox runat="server" ID="UnitNo" CssClass="txtfield" />

td>

tr>

</table>

</asp:WizardStep>

<asp:CompleteWizardStep runat="server">

<p>

Your account has been successfully created.

</p>

<Club:RolloverButton ID="ContinueButton" runat="server" CommandName="Continue"

Text="Continue" />

</ContentTemplate>

</asp:CompleteWizardStep>

</WizardSteps>

<Club:RolloverButton ID="StepPreviousButton" runat="server" CausesValidation="False"

CommandName="MovePrevious" Text="Previous" />

<Club:RolloverButton ID="StepNextButton" runat="server" CommandName="MoveNext"

Text="Next" />

</StepNavigationTemplate>

</asp:CreateUserWizard>

</div>

</div>

asp:Content>

Can anyone provide an example of a page (code) that will activate the user when they click on the link.

Also I want to use the userid

Membership.GetUser.ProviderUserKey.ToString() but I think the email is sent before the user is created so it bombs out.

Any help will be greatly apreciated.

Re: How to send confirmation email to newly registering user via CreateUserWizard

Niall20 — Wed, 13 Dec 2006 14:45:37 GMT

mokeefe:
You should be using the ProviderUserKey which is a property of the MembershipUser object.

Note the ProviderUserKey is of type object and is dependent on the Memebership Provider in use! With the SqlMemebershipProvider ProviderKey can be cast as a guid.

http://msdn2.microsoft.com/en-gb/library/system.web.security.membershipuser.provideruserkey.aspx

You should really be providing both the ProviderUserKey and an hashed signature in the link params ( I deliberately left this out above so as not to confuse the issue).

http://www.mysite.com/emailconfirm?u=guid&h=myhashedvalue.

The hashed value would be an MD5 hash of the UserName (not the exposed ProviderUserKey). This would negate the need for salts as two pieces of the puzzle are not transmitted (not saying not to use unique salts if preferred - when you know what they are).

Basic overview - MD5 hashing takes an input value and produces a hash. This is a one way process, you cannot take the hash and work backwards to the original input. However, the same input always generates the same ouput. Hence if you take the username and generate an MD5 hash, then when the page is requested you can retreive the Membershipuser object, recreate the hash from the username, and confirm that the page was in fact called from your email. In this case this only prevents - which may or may not be really important - the use of a known URL to initialise accounts without actually providing a valid email. This can be extended to providing timestamps and link validity / expirey windows etc.

The ASP SQLMembershipProvider uses Salts with sql accounts.

A salt is a unique value appended to the input value prior to hashing and storage - the password. In additona to the hash the salt is also stored, they are a pair. So "samepassword" + GUID1(salt) generates a hash, but "samepassword + GUID2(salt) generates a different hash. Therefore, the breaking of one account via whatever mechanism does not expose the others - two accounts with the same password do not have the same stored hash value! This configuration is not used where EnablePasswordRecovery is true. Hash passwords are unretreivable, but can be reset etc.

Thats my overkill for today. I hope it makes some sense. And obviously prior to using MD5 hashing or another alternate mechanism you will wish to look it up further on MSDN etc. Then maybe we will see another post - the security Forum would probably be more appropriate for MD5 related questions.

Best Regards,

Martin.

Could you provide an example of how you can utilize this in the context being discussed and how it would be structured in approving users accounts? I dont quite follow what you are saying.

Re: How to send confirmation email to newly registering user via CreateUserWizard

mokeefe — Tue, 12 Dec 2006 23:30:53 GMT

Just noticed this is in security . MD5 hashing might really a bit out of the scope of the question though.

Re: How to send confirmation email to newly registering user via CreateUserWizard

mokeefe — Tue, 12 Dec 2006 22:55:55 GMT

You should be using the ProviderUserKey which is a property of the MembershipUser object.

Note the ProviderUserKey is of type object and is dependent on the Memebership Provider in use! With the SqlMemebershipProvider ProviderKey can be cast as a guid.

http://msdn2.microsoft.com/en-gb/library/system.web.security.membershipuser.provideruserkey.aspx

You should really be providing both the ProviderUserKey and an hashed signature in the link params ( I deliberately left this out above so as not to confuse the issue).

http://www.mysite.com/emailconfirm?u=guid&h=myhashedvalue.

The hashed value would be an MD5 hash of the UserName (not the exposed ProviderUserKey). This would negate the need for salts as two pieces of the puzzle are not transmitted (not saying not to use unique salts if preferred - when you know what they are).

Basic overview - MD5 hashing takes an input value and produces a hash. This is a one way process, you cannot take the hash and work backwards to the original input. However, the same input always generates the same ouput. Hence if you take the username and generate an MD5 hash, then when the page is requested you can retreive the Membershipuser object, recreate the hash from the username, and confirm that the page was in fact called from your email. In this case this only prevents - which may or may not be really important - the use of a known URL to initialise accounts without actually providing a valid email. This can be extended to providing timestamps and link validity / expirey windows etc.

The ASP SQLMembershipProvider uses Salts with sql accounts.

A salt is a unique value appended to the input value prior to hashing and storage - the password. In additona to the hash the salt is also stored, they are a pair. So "samepassword" + GUID1(salt) generates a hash, but "samepassword + GUID2(salt) generates a different hash. Therefore, the breaking of one account via whatever mechanism does not expose the others - two accounts with the same password do not have the same stored hash value! This configuration is not used where EnablePasswordRecovery is true. Hash passwords are unretreivable, but can be reset etc.

Thats my overkill for today. I hope it makes some sense. And obviously prior to using MD5 hashing or another alternate mechanism you will wish to look it up further on MSDN etc. Then maybe we will see another post - the security Forum would probably be more appropriate for MD5 related questions.

Best Regards,

Martin.