Possibility to register over limit

[tmotyl]

Extension version

development branch

Short problem description

Right now the only check for max number of participants is done in rendering the view of the registrationAction (using Event::getRegistrationPossible()).
So every user who opens a registration form before a limit is reached, can submit his registration without an issue.

The same issue will occur when there are few concurrent sessions writing registrations to the db in the same time, as there is no db transaction used.

Solution:

• Add a "currentlyRegistered" property to Event object
• in saveRegistrationAction do select for update the event object
• check if value of the currentlyRegistered is < than limit
• if yes, update currentlyRegistered with the number of registrations
• commit transaction

Unfortunately extbase doesn't provide an api for transactions, we would need to use direct queries for that. eg.

try {
            $db->sql_query("START TRANSACTION");
      
            $result = $db->sql_query("SELECT * FROM ... WHERE  ... LIMIT 1 FOR UPDATE ");
            while ($row = $db->sql_fetch_assoc($result)) {
           
                $update  = $db->sql_query("UPDATE {$tableName} SET ... );
                if (!$update) {
                    throw new \RuntimeException('');
                }
            }

            $insert = $db->exec_INSERTquery($registartionTable, [
             ...
            ]);

            if (!$insert) {
                throw new \RuntimeException('ERROR');
            }

            $db->sql_query("COMMIT");
            return $db->sql_insert_id();
        } catch (\Exception $e) {
$db->sql_query("ROLLBACK");
        }

Steps to reproduce

1. Set limit of registrations to 1
2. Open registration form in two browsers
3. submit one form
4. submit second form

Expected behaviour

Second registration should be rejected

Actual behaviour

Both registrations are accepted

[derhansen]

I could not reproduce the problem with the steps you described. I opened the registration form in 2 browsers for an event with exactly one possible participant and after submitting the second form, the expected message showed up, that the max. participants for the event is reached.

The Event::getRegistrationPossible() is not the only check to make sure, a registration can be created. There is also a check in the saveRegistrationAction, which checks, if the current submitted registration actually should be saved (see: https://github.com/derhansen/sf_event_mgt/blob/development/Classes/Controller/EventController.php#L480)

This check is implemented to make sure, that it is not possible to register over limit. The check takes care of many possible scenarios, but would of course fail, if 2 registrations are submitted at exactly the same time (registration1 and registration2 are both not persisted to DB while saveRegistrationAction is processed). I think, this scenario may only appear in very rare circumstances on high traffic websites with lots of registrations at the same time.

Do you have the "Enable Waitlist" feature enabled for the event? If yes, this seems the only way to save registrations over the configured limit (saved registrations are flagged as "Waitlist Registrations").

If possible, is there any chance to debug your problem together, since I really can't reproduce the problem?

[tmotyl]

You're right, the waitlist was the issue.
However the problem with lack of transactions stays.
With higher load and many registrations, the approach to always count the records to check if the limit was reached will be a performance bootleneck.

I propose to add a field on the Event "amount of registrations" which should be always updated in a transaction to make sure no parallel registrations are happening. Then inserting registration records can happen outside this transaction.

In the past TYPO3 projects I have plenty of issues with many people trying to register in the same time when code was not using transactions. So this issue is not a theoretical case.

[christophlehmann]

Even without Waitlist it seems to be possible that a logged in feuser registrates itself multiple times.

Steps to reproduce:

=> Create Event
=> Activate registration
=> Max concurrent registrations per user: 1
=> Activate auto confirmation
=> Do not enable waitlist
=> Save

=> Login as User
=> Go to registration page
=> Registrate.. success
=> Go to registration page
=> Registrate..success
=> Go to registration page
=> Registrate..success

[derhansen]

You may have got the option "Max. simultaneous registrations per user" wrong.

See: https://docs.typo3.org/p/derhansen/sf_event_mgt/4.1/en-us/ForEditors/Events/Index.html#registration-options

This setting is used to allow a user to create multiple registrations at once. When a user submits a registration with "Amount of registrations" set to "3", then 3 registrations will be created for this user.

The only possibility to check, if a user is already registered to an event is to use the "Enable unique e-mail check for registration" on event basis

[christophlehmann]

Oh, you are right. Sorry for the noise :-)