Changeset 11766 for trunk/src/bp-members/bp-members-template.php

Timestamp:

12/12/2017 02:26:15 AM (9 years ago)

Author:

boonebgorges

Message:

Members: Require a form submission to activate an account.

Previously, simply loading a URL of the form /activate/12345 would activate
the account with key 12345. This caused conflicts with some mail scanning
services, which follow links in emails, causing accounts to be self-activated.

A small backward-compatibility layer ensures that custom activate.php
templates containing forms with action="get" continue to work.

Fixes #6049.

File:

• trunk/src/bp-members/bp-members-template.php (modified) (1 diff)

trunk/src/bp-members/bp-members-template.php

@@ -2119 +2119 @@
 
 /**
+ * Get the activation key from the current request URL.
+ *
+ * @since 3.0.0
+ *
+ * @return string
+ */
+function bp_get_current_activation_key() {
+        $key = '';
+
+        if ( bp_is_current_component( 'activate' ) ) {
+                if ( isset( $_GET['key'] ) ) {
+                        $key = wp_unslash( $_GET['key'] );
+                } else {
+                        $key = bp_current_action();
+                }
+        }
+
+        /**
+         * Filters the activation key from the current request URL.
+         *
+         * @since 3.0.0
+         *
+         * @param string $key Activation key.
+         */
+        return apply_filters( 'bp_get_current_activation_key', $key );
+}
+
+/**
  * Output the username submitted during signup.
  *