Changeset 10938

Timestamp:

07/06/2016 04:39:34 PM (8 years ago)

Author:

imath

Message:

Make sure the password is set to what user chose when signing up with a blog

When signing up, users choose their password and we are hashing them into the meta field of the signups table.
When users activate their accounts, we directly run a query to replace the password automatically generated by WordPress to what the users chose. For the "signup with a blog" case, it appears this is not taking in account because the created users is cached and the xprofile_sync_wp_profile() function is reseting the password to the cached version.
To avoid this, as soon as we run the direct query, we are cleaning the cached object of the created user.

See #7173

Location:

trunk

Files:

• src/bp-members/bp-members-functions.php (modified) (1 diff)
• tests/phpunit/testcases/members/functions.php (modified) (1 diff)

trunk/src/bp-members/bp-members-functions.php

@@ -2066 +2066 @@
     }
 
-    // Update the display_name.
-    wp_update_user( array(
-        'ID'           => $user_id,
-        'display_name' => bp_core_get_user_displayname( $user_id ),
-    ) );
-
-    // Set the password on multisite installs.
+    // Replace the password automatically generated by WordPress by the one the user chose.
     if ( ! empty( $user['meta']['password'] ) ) {
         $wpdb->query( $wpdb->prepare( "UPDATE {$wpdb->users} SET user_pass = %s WHERE ID = %d", $user['meta']['password'], $user_id ) );
+
+        /**
+         * Make sure to clean the user's cache as we've
+         * directly edited the password without using
+         * wp_update_user().
+         *
+         * If we can't use wp_update_user() that's because
+         * we already hashed the password at the signup step.
+         */
+        $uc = wp_cache_get( $user_id, 'users' );
+
+        if ( ! empty( $uc->ID ) ) {
+            clean_user_cache( $uc->ID );
+        }
     }
 

trunk/tests/phpunit/testcases/members/functions.php

@@ -588 +588 @@
         $this->assertSame( bp_get_signup_page(), wp_registration_url() );
     }
+
+    /**
+     * @group bp_core_activate_signup
+     */
+    public function test_bp_core_activate_signup_password() {
+        global $wpdb;
+
+
+        $signups = array( 'no-blog' =>
+            array( 'signup_id' => $this->factory->signup->create( array(
+                    'user_login'     => 'noblog',
+                    'user_email'     => 'noblog@example.com',
+                    'activation_key' => 'no-blog',
+                    'meta' => array(
+                        'field_1' => 'Foo Bar',
+                        'password' => 'foobar',
+                    ),
+            ) ),
+                'password' => 'foobar',
+            ),
+        );
+
+        if ( is_multisite() ) {
+            $signups['ms-blog'] = array( 'signup_id' => $this->factory->signup->create( array(
+                    'user_login'     => 'msblog',
+                    'user_email'     => 'msblog@example.com',
+                    'domain'         => get_current_site()->domain,
+                    'path'           => get_current_site()->path . 'ms-blog',
+                    'title'          => 'Ding Dang',
+                    'activation_key' => 'ms-blog',
+                    'meta' => array(
+                        'field_1'  => 'Ding Dang',
+                        'password' => 'dingdang',
+                    ),
+                ) ),
+                'password' => 'dingdang',
+            );
+        }
+
+        // Neutralize db errors
+        $suppress = $wpdb->suppress_errors();
+
+        foreach ( $signups as $key => $data ) {
+            $u = bp_core_activate_signup( $key );
+
+            $this->assertEquals( get_userdata( $u )->user_pass, $data['password'] );
+        }
+
+        $wpdb->suppress_errors( $suppress );
+    }
 }