Changeset 11766 for trunk/src/bp-members/bp-members-actions.php

Timestamp:

12/12/2017 02:26:15 AM (8 years ago)

Author:

boonebgorges

Message:

Members: Require a form submission to activate an account.

Previously, simply loading a URL of the form /activate/12345 would activate
the account with key 12345. This caused conflicts with some mail scanning
services, which follow links in emails, causing accounts to be self-activated.

A small backward-compatibility layer ensures that custom activate.php
templates containing forms with action="get" continue to work.

Fixes #6049.

File:

• trunk/src/bp-members/bp-members-actions.php (modified) (1 diff)

trunk/src/bp-members/bp-members-actions.php

@@ -108 +108 @@
 }
 
+/**
+ * Catches and processes account activation requests.
+ *
+ * @since 3.0.0
+ */
+function bp_members_action_activate_account() {
+    if ( ! bp_is_current_component( 'activate' ) ) {
+        return;
+    }
+
+    if ( is_user_logged_in() ) {
+        return;
+    }
+
+    if ( ! empty( $_POST['key'] ) ) {
+        $key = wp_unslash( $_POST['key'] );
+
+    // Backward compatibility with templates using `method="get"` in their activation forms.
+    } elseif ( ! empty( $_GET['key'] ) ) {
+        $key = wp_unslash( $_GET['key'] );
+    }
+
+    if ( empty( $key ) ) {
+        return;
+    }
+
+    $bp = buddypress();
+
+    /**
+     * Filters the activation signup.
+     *
+     * @since 1.1.0
+     *
+     * @param bool|int $value Value returned by activation.
+     *                        Integer on success, boolean on failure.
+     */
+    $user = apply_filters( 'bp_core_activate_account', bp_core_activate_signup( $key ) );
+
+    // If there were errors, add a message and redirect.
+    if ( ! empty( $user->errors ) ) {
+        bp_core_add_message( $user->get_error_message(), 'error' );
+        bp_core_redirect( trailingslashit( bp_get_root_domain() . '/' . $bp->pages->activate->slug ) );
+    }
+
+    bp_core_add_message( __( 'Your account is now active!', 'buddypress' ) );
+    bp_core_redirect( add_query_arg( 'activated', '1', bp_get_activation_page() ) );
+
+}
+add_action( 'bp_actions', 'bp_members_action_activate_account' );
+
 /*
  * Unhooked in 1.6.0 - moved to settings