Portal User Spam

Question

Hi all,

for some weeks, my database is being misused by someone that creates new portal users on a daily basis. So far, more than 1000 accounts have been created. Their names are always bogus but the email addresses sometimes seem real, sometimes not.

Do you have any idea how to stop this? / Block the Attacker? Its probably harmless, as these users are followers nowhere but its annoying to the whole company as they keep popping up in many2one fields.

Image [1]

[1] data:image/png;base64,iVBO

Altela · Accepted Answer

Hi everyone,
having the same problem as well and it seems like the community is working on it. Here's the discussion :  https://github.com/odoo/odoo/pull/190196 [1]
its about implementing Google Recaptcha and potentially Cloudflare Turnstile (definitely on signup and login views)

[1] https://github.com/odoo/odoo/pull/190196

Javier Ruiz Diez - 71341924H · Answer

Please check:-
https://apps.odoo.com/apps/modules/18.0/recaptcha_signup [1]

[1] https://apps.odoo.com/apps/modules/18.0/recaptcha_signup

Niyas Raphy (Walnut Software Solutions) · Answer

Hi,
Have a look at this thread:   https://github.com/odoo/odoo/pull/185648 [1]
Thanks

[1] https://github.com/odoo/odoo/pull/185648

J.A. Daniel Göppner · Answer

Hi Friedrich
Such jobs are done by requests or api, one good solution is to activate the re*CAPT*CHA if did not yet so you can block robots from do it it
you can also integrate clodflare captcha or a honeypot strategy

If this persists, you still have the possibility to force email confirmation when sign/up or SMS confirmation or force 2FA for your account
In this case, an account will be active only when it's legit

Advanced option: Block IP's where accounts are created within x minute
block ge

James Biggerstaff · Answer

I have a solution that seems to be working for my instance (Odoo 16). I posted it in the Odoo App store as "Website Signup Protection" module. It added some validation and verification to the signup process and I haven't gotten any fake accounts since I installed it.

Jean-Sebastien Dupuis · Answer

I get the same thing and also looking for a solution. These spam signups eat more than half my daily limit of emails on Odoo Online (200 emails per day). Following.

Related Posts	Replies	Rodiniai
Query Releted to Portal user openerp 7 user portal	0 kov. 15	5070
Why shared project portal user has no access to project? project user portal	0 kov. 15	6331
Extension of portal user information not working well user portal extension ecommerce	2 rugs. 25	1830
Approve timesheets as a portal user user timesheet portal approval	0 lapkr. 25	5849
ValueError: Expected singleton: res.partner() when I try to give Portal Access to a customer Solved portal	2 saus. 26	2446

This question has been flagged

Enjoying the discussion? Don't just read, join in!