Changeset 10941 for trunk/src/bp-core/bp-core-filters.php

Timestamp:

07/10/2016 09:46:27 PM (8 years ago)

Author:

djpaul

Message:

Emails: add unsubscribe feature.

Updates the unsubscribe token to link to a new unsubscribe action handler.

All emails from other platforms or popular websites have a unsubscribe link. For previous versions of BuddyPress, our unsubscribe link pointed to that user's notifications page. However, if someone creates an account on a BuddyPress with a fraudulent email address (for example), that email address' owner will not know the account's authentication details, and so have no way to unsubscribe from that "spam" email.

The change implements a new action handler which accepts unsubscription requests from un-authenticated requests. It adds an new option containing a dynamically generated salt which is used to generate the hash on the unsubscribe link.

Fixes #6932

Props tharsheblows, DJPaul

File:

• trunk/src/bp-core/bp-core-filters.php (modified) (2 diffs)

trunk/src/bp-core/bp-core-filters.php

@@ -1031 +1031 @@
     $tokens['recipient.name']      = '';
     $tokens['recipient.username']  = '';
-    $tokens['unsubscribe']         = site_url( 'wp-login.php' );
 
 
@@ -1048 +1047 @@
 
         if ( $user_obj ) {
-            // Unsubscribe link.
-            $tokens['unsubscribe'] = esc_url( sprintf(
-                '%s%s/notifications/',
-                bp_core_get_user_domain( $user_obj->ID ),
-                function_exists( 'bp_get_settings_slug' ) ? bp_get_settings_slug() : 'settings'
-            ) );
             $tokens['recipient.username'] = $user_obj->user_login;
-        }
+            if ( bp_is_active( 'settings' ) && empty( $tokens['unsubscribe'] ) ) {
+                $tokens['unsubscribe'] = esc_url( sprintf(
+                    '%s%s/notifications/',
+                    bp_core_get_user_domain( $user_obj->ID ),
+                    bp_get_settings_slug()
+                ) );
+            }
+        }
+    }
+
+    // Set default unsubscribe link if not passed.
+    if ( empty( $tokens['unsubscribe'] ) ) {
+        $tokens['unsubscribe'] = site_url( 'wp-login.php' );
     }