Changeset 6269

Timestamp:

08/29/2012 06:47:11 PM (13 years ago)

Author:

boonebgorges

Message:

Fixes email validation in Settings component

When changing your email in the Settings component, this changeset ensures that
the new address is validated in all the crucial ways, specifically the
banned_email_domains and limited_email_domains checks on WordPress Multisite.

Fixes #4485

Location:

trunk

Files:

• bp-members/bp-members-functions.php (modified) (1 diff)
• bp-settings/bp-settings-actions.php (modified) (1 diff)

trunk/bp-members/bp-members-functions.php

@@ -971 +971 @@
 
 /**
+ * Check that an email address is valid for use
+ *
+ * Performs the following checks:
+ *   - Is the email address well-formed?
+ *   - Is the email address already used?
+ *   - If there's an email domain blacklist, is the current domain on it?
+ *   - If there's an email domain whitelest, is the current domain on it?
+ *
+ * @since 1.6.2
+ *
+ * @param string $user_email The email being checked
+ * @return bool|array True if the address passes all checks; otherwise an array
+ *   of error codes
+ */
+function bp_core_validate_email_address( $user_email ) {
+    $errors = array();
+
+    $user_email = sanitize_email( $user_email );
+
+    // Is the email well-formed?
+    if ( ! is_email( $user_email ) )
+        $errors['invalid'] = 1;
+
+    // Is the email on the Banned Email Domains list?
+    // Note: This check only works on Multisite
+    if ( function_exists( 'is_email_address_unsafe' ) && is_email_address_unsafe( $user_email ) )
+        $errors['domain_banned'] = 1;
+
+    // Is the email on the Limited Email Domains list?
+    // Note: This check only works on Multisite
+    $limited_email_domains = get_site_option( 'limited_email_domains' );
+    if ( is_array( $limited_email_domains ) && empty( $limited_email_domains ) == false ) {
+        $emaildomain = substr( $user_email, 1 + strpos( $user_email, '@' ) );
+        if ( ! in_array( $emaildomain, $limited_email_domains ) ) {
+            $errors['domain_not_allowed'] = 1;
+        }
+    }
+
+    // Is the email alreday in use?
+    if ( email_exists( $user_email ) )
+        $errors['in_use'] = 1;
+
+    $retval = ! empty( $errors ) ? $errors : true;
+
+    return $retval;
+}
+
+/**
  * Validate a user name and email address when creating a new user.
+ *
+ * @todo Refactor to use bp_core_validate_email_address()
  *
  * @param string $user_name Username to validate

trunk/bp-settings/bp-settings-actions.php

@@ -72 +72 @@
                 if ( $bp->displayed_user->userdata->user_email != $user_email ) {
 
-                    // Is email valid
-                    if ( !is_email( $user_email ) )
-                        $email_error = 'invalid';
-
-                    // Get blocked email domains
-                    $limited_email_domains = get_site_option( 'limited_email_domains', 'buddypress' );
-
-                    // If blocked email domains exist, see if this is one of them
-                    if ( is_array( $limited_email_domains ) && empty( $limited_email_domains ) == false ) {
-                        $emaildomain = substr( $user_email, 1 + strpos( $user_email, '@' ) );
-
-                        if ( in_array( $emaildomain, (array) $limited_email_domains ) == false ) {
+                    // Run some tests on the email address
+                    $email_checks = bp_core_validate_email_address( $user_email );
+
+                    if ( true !== $email_checks ) {
+                        if ( isset( $email_checks['invalid'] ) ) {
+                            $email_error = 'invalid';
+                        }
+
+                        if ( isset( $email_checks['domain_banned'] ) || isset( $email_checks['domain_not_allowed'] ) ) {
                             $email_error = 'blocked';
                         }
-                    }
-
-                    // No errors, and email address doesn't match
-                    if ( ( false === $email_error ) && email_exists( $user_email ) ) {
-                        $email_error = 'taken';
+
+                        if ( isset( $email_checks['in_use'] ) ) {
+                            $email_error = 'taken';
+                        }
                     }