Changeset 5841

Timestamp:

02/25/2012 06:25:40 PM (13 years ago)

Author:

boonebgorges

Message:

Some hardening of the member registration process:

• Ensures that pre_user_login filters are applied before attempting to create a user with wp_insert_user(), so that BP's username validation is the same as WP's, and username_exists() checks are reliable.
• Check to see whether the return value of wp_insert_user() is a WP_Error object before continuing with the registration process.
• Improves error handling during user creation, by correctly parsing WP_Error objects returned from wp_insert_user().

See #3949.

File:

• branches/1.5/bp-members/bp-members-signup.php (modified) (3 diffs)

branches/1.5/bp-members/bp-members-signup.php

@@ -151 +151 @@
                 // Finally, sign up the user and/or blog
                 if ( isset( $_POST['signup_with_blog'] ) && is_multisite() )
-                    bp_core_signup_blog( $blog_details['domain'], $blog_details['path'], $blog_details['blog_title'], $_POST['signup_username'], $_POST['signup_email'], $usermeta );
+                    $wp_user_id = bp_core_signup_blog( $blog_details['domain'], $blog_details['path'], $blog_details['blog_title'], $_POST['signup_username'], $_POST['signup_email'], $usermeta );
                 else
-                    bp_core_signup_user( $_POST['signup_username'], $_POST['signup_password'], $_POST['signup_email'], $usermeta );
-
-                $bp->signup->step = 'completed-confirmation';
+                    $wp_user_id = bp_core_signup_user( $_POST['signup_username'], $_POST['signup_password'], $_POST['signup_email'], $usermeta );
+
+                if ( is_wp_error( $wp_user_id ) ) {                                   
+                    $bp->signup->step = 'request-details';
+                    bp_core_add_message( strip_tags( $wp_user_id->get_error_message() ), 'error' );
+                } else {
+                    $bp->signup->step = 'completed-confirmation';
+                } 
             }
 
@@ -305 +310 @@
     $user_email = sanitize_email( $user_email );
 
+    // Apply any user_login filters added by BP or other plugins before validating 
+    $user_name = apply_filters( 'pre_user_login', $user_name ); 
+
     if ( empty( $user_name ) )
         $errors->add( 'user_name', __( 'Please enter a username', 'buddypress' ) );
@@ -391 +399 @@
         ) );
 
-        if ( empty( $user_id ) ) {
+        if ( is_wp_error( $user_id ) || empty( $user_id ) ) {
             $errors->add( 'registerfail', sprintf( __('<strong>ERROR</strong>: Couldn&#8217;t register you... please contact the <a href="mailto:%s">webmaster</a> !', 'buddypress' ), get_option( 'admin_email' ) ) );
             return $errors;