[MokoCBRegGuard] [FEATURE] Trusted IP and email domain whitelist bypass #19

New Issue

2026-06-02T19:31:34Z

jmiller commented

2026-06-02 19:31:34 +00:00

Migrated from MokoCBRegGuard#21

Feature Description

Add a whitelist/trust system that allows known-good IPs and email domains to bypass all RegGuard checks.

Problem or Use Case

Legitimate bulk registrations — staff onboarding, event signups, partner accounts — trigger false positives. Office IPs registering multiple accounts hit the IP frequency check. Corporate email domains are unnecessarily scanned. There is currently no way to exempt known-good sources.

Proposed Solution

Add trust/whitelist parameters:

trusted_ips — comma-separated IPs or CIDR ranges that bypass all checks
trusted_email_domains — comma-separated domains that bypass all checks

When a registration matches a trusted entry:

Skip all check methods
Log with TRUSTED_BYPASS note (maintain audit trail)
Set risk level to LOW with score 0

Alternative Solutions

Temporarily disable the plugin during bulk signups (risky, leaves site unprotected)
Raise thresholds globally (weakens protection for all registrations)

Benefits

Who: Administrators managing legitimate bulk signups, organizations with known office IPs
Problem solved: Eliminates false positives for trusted sources without weakening overall protection
Value: Reduces moderator workload and prevents legitimate users from being flagged

Implementation Details (Optional)

New params in cbregguard.xml: trusted_ips, trusted_email_domains
Early-exit check in cbregguard.php before running any checks
CIDR matching support for IP ranges using inet_pton() and bitmask comparison
Still log the registration (with TRUSTED_BYPASS) to maintain complete audit trail

Relevant Standards

Security best practices
Code quality standards

Checklist

I have searched for similar feature requests before creating this one
I have clearly described the use case and benefits
I have considered alternative solutions
This feature aligns with the project's goals and scope

> Migrated from MokoCBRegGuard#21 ## Feature Description Add a whitelist/trust system that allows known-good IPs and email domains to bypass all RegGuard checks. ## Problem or Use Case Legitimate bulk registrations — staff onboarding, event signups, partner accounts — trigger false positives. Office IPs registering multiple accounts hit the IP frequency check. Corporate email domains are unnecessarily scanned. There is currently no way to exempt known-good sources. ## Proposed Solution Add trust/whitelist parameters: - `trusted_ips` — comma-separated IPs or CIDR ranges that bypass all checks - `trusted_email_domains` — comma-separated domains that bypass all checks When a registration matches a trusted entry: - Skip all check methods - Log with `TRUSTED_BYPASS` note (maintain audit trail) - Set risk level to LOW with score 0 ## Alternative Solutions - Temporarily disable the plugin during bulk signups (risky, leaves site unprotected) - Raise thresholds globally (weakens protection for all registrations) ## Benefits - **Who:** Administrators managing legitimate bulk signups, organizations with known office IPs - **Problem solved:** Eliminates false positives for trusted sources without weakening overall protection - **Value:** Reduces moderator workload and prevents legitimate users from being flagged ## Implementation Details (Optional) - New params in `cbregguard.xml`: `trusted_ips`, `trusted_email_domains` - Early-exit check in `cbregguard.php` before running any checks - CIDR matching support for IP ranges using `inet_pton()` and bitmask comparison - Still log the registration (with `TRUSTED_BYPASS`) to maintain complete audit trail ## Relevant Standards - [x] Security best practices - [x] Code quality standards ## Checklist - [x] I have searched for similar feature requests before creating this one - [x] I have clearly described the use case and benefits - [x] I have considered alternative solutions - [x] This feature aligns with the project's goals and scope

jmiller added the pending: testing regguard labels 2026-06-02 19:52:03 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoJoomCommunity#19