Multiple login

Hi szt,

Thank you for trying out the module.

I have noticed this issue happen twice on the demo site. I have cleaned up the duplicate users.

I have not been able to ascertain if the user had any malicious intention to spam or if the login redirection went into a loop creating duplicate users. If this was a bug, I haven't been able to reproduce it.

I shall look into this further to see if i can find any patterns between the two users with which this issue was caused on the demo site.

Please do add in if you have any further information about this probable bug.

Cheers
Tanay

Hi,

I've same problem with my website. When a user who restrict access to his/her e-mail address within Facebook, try to register to my website, creates multiple account. I also use Email Registration module.

I use Simple FB Connect 7.x-1.9 version.

User can deny access to their email address and/ or revoke email address read permission. So that's why this module will create multiple username until it timeout by it self.

To work around this, ideally we should check for the app permission every time.
Edit the module into this:

$fb_user_profile = $facebook->api('/me');
      if(empty($fb_user_profile['email'])){
        $login_url_params = array(
          'scope' => 'email',
          'fbconnect' => 1,
          'auth_type' => 'rerequest',
          'redirect_uri' => 'http://' . $_SERVER['HTTP_HOST'] . request_uri(),
        );

        $login_url = $facebook->getLoginUrl($login_url_params);
          
        drupal_set_message(t('Could not login with Facebook. You did not grant permission for this app to access your email address. Click !here to try again.',
          array('!here' => l('here', $login_url))), 'error');
        drupal_goto('user');
      }

Then add re-request auth for the email. If not, when user denies access to their email once, facebook won't ask again:

          $login_url_params = array(
            'scope' => 'email',
            'fbconnect' => 1,
            'auth_type' => 'rerequest',
            'redirect_uri' => 'http://' . $_SERVER['HTTP_HOST'] . request_uri(),
          );

This work for me.
I've edited much of this module as I try to used this into production site by today. So far, my beta testers can't find any more issues. Thanks for the great module!

The module already checks for

$fb_user = $facebook->getUser();

    if ($fb_user) {...

    else {
      if (!isset($_REQUEST['error'])) {
        if (variable_get('simple_fb_connect_appid', 0)) {
          $login_url_params = array(
            'scope' => 'email',
            'fbconnect' => 1,
            'redirect_uri' => 'http://' . $_SERVER['HTTP_HOST'] . request_uri(),
          );
          $login_url = $facebook->getLoginUrl($login_url_params);
          drupal_goto($login_url);
        }
        else {
          drupal_set_message(t('Facebook App ID Missing. Can not perform Login now. Contact Site administrator.'), 'error');
          drupal_goto("user");
        }
      }
      else {
        if ($_REQUEST['error'] == SIMPLE_FB_CONNECT_PERMISSION_DENIED_PARAMETER) {
          drupal_set_message(t('Could not login with facebook. You did not grant permission for this app on facebook to access your email address.'), 'error');
        }
        else {
          drupal_set_message(t('There was a problem in logging in with facebook. Contact site administrator.'), 'error');
        }
        drupal_goto('user');
      }
    }

If $fb_user_profile is loaded, there is no way that it could be available without the email address.

Users can not revoke the app permission's email address alone.

If the app permission is revoked, it is handled at

  if ($_REQUEST['error'] == SIMPLE_FB_CONNECT_PERMISSION_DENIED_PARAMETER) {
          drupal_set_message(t('Could not login with facebook. You did not grant permission for this app on facebook to access your email address.'), 'error');
        }

The issue was probably somewhere else. Trying to replicate. Checked the below scenarios and it works fine:
1) User rejects permission while registering for first time
2) User grants permission while registering, later revokes offline from FB and tries to login, rejects when asked for permission

Ok, so when I try to replicate this. Yes I think mine is different issues. Will create a new one

Hi,
I'm facing the same issue.
I'm getting more than 100 email with title "Mail Failure - No recipient address " everytime.
I checked the use account, it has no email associated with the account, so i guess the user did not use email to register facebook account?
I heard there is something like register using mobile phone number, but i'm not sure.

It is true that you can get an FB account without an Email address from:
http://touch.facebook.com/r.php

I created one such account and tried logging into to the demo site www.simplefbconnect.com only to see the error message from the module as
"Though you have authorised the Facebook app to access your profile, you have revoked the permission to access email address. Please contact site administrator."

I acknowledge the issue as more than 1 user reported the same. However it seems to very rarely happen and I haven't been able to replicate it to be able to fix it.

While I try out more scenarios to replicate the issue, please ensure you got the latest version of the module installed.

Cheers
tanay