Changeset 3524

Timestamp:

12/11/2010 01:38:11 PM (16 years ago)

Author:

boonebgorges

Message:

Adds password verification before an email address or password change on the General Settings screen. Fixes #2517. Props nuprn1 and r-a-y

Location:

trunk

Files:

• bp-core/bp-core-settings.php (modified) (6 diffs)
• bp-themes/bp-default/members/single/plugins.php (modified) (1 diff)

trunk/bp-core/bp-core-settings.php

@@ -32 +32 @@
 
 function bp_core_screen_general_settings() {
-        global $current_user, $bp_settings_updated, $pass_error;
+        global $current_user, $bp_settings_updated, $pass_error, $email_error, $pwd_error;
 
         $bp_settings_updated = false;
         $pass_error = false;
+        $email_error = false;
+        $pwd_error = false;
 
         if ( isset($_POST['submit']) ) {
@@ -43 +45 @@
 
                 // Form has been submitted and nonce checks out, lets do it.
-
-                if ( $_POST['email'] != '' )
-                        $current_user->user_email = esc_html( trim( $_POST['email'] ) );
-
-                if ( $_POST['pass1'] != '' && $_POST['pass2'] != '' ) {
-                        if ( $_POST['pass1'] == $_POST['pass2'] && !strpos( " " . $_POST['pass1'], "\\" ) )
-                                $current_user->user_pass = $_POST['pass1'];
-                        else
-                                $pass_error = true;
-                } else if ( empty( $_POST['pass1'] ) && !empty( $_POST['pass2'] ) || !empty( $_POST['pass1'] ) && empty( $_POST['pass2'] ) ) {
-                        $pass_error = true;
-                } else {
-                        unset( $current_user->user_pass );
-                }
-
-                if ( !$pass_error && wp_update_user( get_object_vars( $current_user ) ) )
-                        $bp_settings_updated = true;
-                        
+                
+                // Validate the user again for the current password when making a big change
+                if ( !empty( $_POST['pwd'] ) && $_POST['pwd'] != '' && wp_check_password($_POST['pwd'], $current_user->user_pass, $current_user->ID) ) {
+ 
+                        // Make sure changing an email address does not already exist
+                        if ( $_POST['email'] != '' ) {
+ 
+                                // What is missing from the profile page vs signup - lets double check the goodies
+                                $user_email = sanitize_email( wp_specialchars( trim( $_POST['email'] ) ) );
+ 
+                                if ( !is_email( $user_email ) )
+                                        $email_error = true;
+ 
+                                $limited_email_domains = get_site_option( 'limited_email_domains', 'buddypress' );
+ 
+                                if ( is_array( $limited_email_domains ) && empty( $limited_email_domains ) == false ) {
+                                        $emaildomain = substr( $user_email, 1 + strpos( $user_email, '@' ) );
+ 
+                                        if ( in_array( $emaildomain, (array)$limited_email_domains ) == false ) {
+                                                $email_error = true;
+                                                
+                                        }
+                                }
+ 
+                                if ( !$email_error && $current_user->user_email != $user_email  ) {
+                                
+                                        //we don't want email dups in the system
+                                        if ( email_exists( $user_email ) )
+                                                $email_error = true;
+                                                
+                                        if (!$email_error)
+                                                $current_user->user_email = $user_email;
+                                }
+                        }
+ 
+                        if ( $_POST['pass1'] != '' && $_POST['pass2'] != '' ) {
+                        
+                                if ( $_POST['pass1'] == $_POST['pass2'] && !strpos( " " . $_POST['pass1'], "\\" ) )
+                                        $current_user->user_pass = $_POST['pass1'];
+                                else
+                                        $pass_error = true;
+  
+                        } else if ( empty( $_POST['pass1'] ) && !empty( $_POST['pass2'] ) || !empty( $_POST['pass1'] ) && empty( $_POST['pass2'] ) ) {
+                                $pass_error = true;
+                        } else {
+                                unset( $current_user->user_pass );
+                        }
+ 
+                        if ( !$email_error && !$pass_error && wp_update_user( get_object_vars( $current_user ) ) )
+                                $bp_settings_updated = true;
+                        
+                } else {
+                        $pwd_error = true;
+                }
+                
                 do_action( 'bp_core_general_settings_after_save' );
         }
@@ -75 +114 @@
 
 function bp_core_screen_general_settings_content() {
-        global $bp, $current_user, $bp_settings_updated, $pass_error; ?>
+        global $bp, $current_user, $bp_settings_updated, $pass_error, $pwd_error, $email_error; ?>
 
         <?php if ( $bp_settings_updated && !$pass_error ) { ?>
@@ -88 +127 @@
                 </div>
         <?php } ?>
+        
+        <?php if ( $pwd_error && !$bp_settings_updated ) { ?>
+                <div id="message" class="error fade">
+                        <p><?php _e( 'Your password is incorrect', 'buddypress' ) ?></p>
+                </div>
+        <?php } ?>
+
+        <?php 
+        if ( $email_error && !$bp_settings_updated ) { ?>
+                <div id="message" class="error fade">
+                        <p><?php _e( 'Sorry, that email address is already used or is invalid', 'buddypress' ) ?></p>
+                </div>
+        <?php } ?>
+
 
         <form action="<?php echo $bp->loggedin_user->domain . BP_SETTINGS_SLUG . '/general' ?>" method="post" class="standard-form" id="settings-form">
+
+                <label for="pwd"><?php _e( 'Current Password <span>(required to update email or change current password)</span>', 'buddypress' ) ?></label>
+                <input type="password" name="pwd" id="pwd" size="16" value="" class="settings-input small" /> &nbsp;<a href="<?php echo site_url('wp-login.php?action=lostpassword', 'login') ?>" title="<?php _e('Password Lost and Found') ?>"><?php _e('Lost your password?') ?></a>
+
                 <label for="email"><?php _e( 'Account Email', 'buddypress' ) ?></label>
                 <input type="text" name="email" id="email" value="<?php echo esc_attr( $current_user->user_email ); ?>" class="settings-input" />
@@ -138 +195 @@
 
 function bp_core_screen_notification_settings_title() {
-        echo apply_filters( 'bp_core_notification_settings_title', __( 'Notification Settings', 'buddypress' ) );;
+        echo apply_filters( 'bp_core_notification_settings_title', __( 'Email Notifications', 'buddypress' ) );;
 }
 
@@ -151 +208 @@
 
         <form action="<?php echo $bp->loggedin_user->domain . BP_SETTINGS_SLUG . '/notifications' ?>" method="post" id="settings-form">
-                <h3><?php _e( 'Email Notifications', 'buddypress' ) ?></h3>
                 <p><?php _e( 'Send a notification by email when:', 'buddypress' ) ?></p>
 

trunk/bp-themes/bp-default/members/single/plugins.php

@@ -31 +31 @@
                                 </div><!-- .item-list-tabs -->
 
-                                <?php do_action( 'bp_template_title' ) ?>
+                                <h3><?php do_action( 'bp_template_title' ) ?></h3>
 
                                 <?php do_action( 'bp_template_content' ) ?>