diff --git Users/cavinsd/Downloads/buddypress-14.3.4/bp-core/bp-core-functions.php Users/cavinsd/Downloads/buddypress-14.4.0/bp-core/bp-core-functions.php
index 6da93ff6..561b6b49 100644
--- Users/cavinsd/Downloads/buddypress-14.3.4/bp-core/bp-core-functions.php
+++ Users/cavinsd/Downloads/buddypress-14.4.0/bp-core/bp-core-functions.php
@@ -4577,10 +4577,18 @@ function bp_email_unsubscribe_handler() {
// Unsubscribe.
$meta_key = $emails[ $raw_email_type ]['unsubscribe']['meta_key'];
- bp_update_user_meta( $raw_user_id, $meta_key, 'no' );
+
+ if ( 'no' !== bp_get_user_meta( $raw_user_id, $meta_key, true ) ) {
+ bp_update_user_meta( $raw_user_id, $meta_key, 'no' );
+ }
$result_msg = $emails[ $raw_email_type ]['unsubscribe']['message'];
- $unsub_msg = __( 'You can change this or any other email notification preferences in your email settings.', 'buddypress' );
+
+ if ( bp_is_active( 'settings' ) ) {
+ $unsub_msg = __( 'You can change this or any other email notification preferences in your email settings.', 'buddypress' );
+ } else {
+ $unsub_msg = '';
+ }
}
if ( $raw_user_id && $redirect_to ) {
@@ -4592,8 +4600,19 @@ function bp_email_unsubscribe_handler() {
);
// Template notices are only displayed on BP pages.
- bp_core_add_message( $message );
- bp_core_redirect( bp_members_get_user_url( $raw_user_id ) );
+ if ( is_user_logged_in() ) {
+ bp_core_add_message( $message );
+ bp_core_redirect( bp_members_get_user_url( $raw_user_id ) );
+ } else {
+ wp_die(
+ sprintf( '%1$s %3$s', esc_html( $result_msg ), esc_url( $redirect_to ), esc_html( $unsub_msg ) ),
+ esc_html( $unsub_msg ),
+ array(
+ 'link_url' => esc_url( home_url() ),
+ 'link_text' => esc_html__( 'Go to website\'s home page.', 'buddypress' ),
+ )
+ );
+ }
exit;
} else {
diff --git Users/cavinsd/Downloads/buddypress-14.3.4/bp-loader.php Users/cavinsd/Downloads/buddypress-14.4.0/bp-loader.php
index 8b1da486..79f3d24a 100644
--- Users/cavinsd/Downloads/buddypress-14.3.4/bp-loader.php
+++ Users/cavinsd/Downloads/buddypress-14.4.0/bp-loader.php
@@ -21,7 +21,7 @@
* Domain Path: /bp-languages/
* Requires PHP: 5.6
* Requires at least: 6.1
- * Version: 14.3.4
+ * Version: 14.4.0
*/
/**
diff --git Users/cavinsd/Downloads/buddypress-14.3.4/bp-members/classes/class-bp-rest-signup-endpoint.php Users/cavinsd/Downloads/buddypress-14.4.0/bp-members/classes/class-bp-rest-signup-endpoint.php
index aabca216..2fd778f9 100644
--- Users/cavinsd/Downloads/buddypress-14.3.4/bp-members/classes/class-bp-rest-signup-endpoint.php
+++ Users/cavinsd/Downloads/buddypress-14.4.0/bp-members/classes/class-bp-rest-signup-endpoint.php
@@ -706,7 +706,7 @@ class BP_REST_Signup_Endpoint extends WP_REST_Controller {
$activation_key = $request->get_param( 'activation_key' );
// Get the signup to activate thanks to the activation key.
- $signup = $this->get_signup_object( $activation_key );
+ $signup = $this->get_signup_object_by_field( $activation_key, 'activation_key' );
$activated = bp_core_activate_signup( $activation_key );
if ( ! $activated ) {
@@ -761,8 +761,19 @@ class BP_REST_Signup_Endpoint extends WP_REST_Controller {
// Get the activation key.
$activation_key = $request->get_param( 'activation_key' );
+ // Block numeric IDs to prevent enumeration attacks.
+ if ( is_numeric( $activation_key ) ) {
+ return new WP_Error(
+ 'bp_rest_invalid_activation_key_format',
+ __( 'Invalid activation key format.', 'buddypress' ),
+ array(
+ 'status' => 400,
+ )
+ );
+ }
+
// Check the activation key is valid.
- if ( $this->get_signup_object( $activation_key ) ) {
+ if ( $this->get_signup_object_by_field( $activation_key, 'activation_key' ) ) {
$retval = true;
}
@@ -988,6 +999,49 @@ class BP_REST_Signup_Endpoint extends WP_REST_Controller {
return false;
}
+ /**
+ * Get signup object by specific field with security validation.
+ *
+ * @since 14.4.0
+ *
+ * @param int|string $identifier Signup identifier.
+ * @param string $field Signup lookup field ('id', 'email', or 'activation_key').
+ * @return BP_Signup|false
+ */
+ public function get_signup_object_by_field( $identifier, $field ) {
+ $signup_args = array();
+
+ if ( 'id' === $field && is_numeric( $identifier ) ) {
+ $signup_args['include'] = array( intval( $identifier ) );
+ } else if ( 'email' === $field && is_email( $identifier ) ) {
+ $signup_args['usersearch'] = $identifier;
+ } else if ( 'activation_key' === $field ) {
+ // The activation key is used when activating a signup.
+
+ // Block numeric IDs to prevent enumeration attacks.
+ if ( is_numeric( $identifier ) ) {
+ return false;
+ }
+
+ // Basic validation: minimum length check.
+ if ( empty( $identifier ) || strlen( $identifier ) < 10 ) {
+ return false;
+ }
+ $signup_args['activation_key'] = $identifier;
+ }
+
+ if ( ! empty( $signup_args ) ) {
+ // Get signups.
+ $signups = \BP_Signup::get( $signup_args );
+
+ if ( ! empty( $signups['signups'] ) ) {
+ return reset( $signups['signups'] );
+ }
+ }
+
+ return false;
+ }
+
/**
* Check a user password for the REST API.
*
diff --git Users/cavinsd/Downloads/buddypress-14.3.4/buddypress.pot Users/cavinsd/Downloads/buddypress-14.4.0/buddypress.pot
index f9029e5f..b69ef34e 100644
--- Users/cavinsd/Downloads/buddypress-14.3.4/buddypress.pot
+++ Users/cavinsd/Downloads/buddypress-14.4.0/buddypress.pot
@@ -9,7 +9,7 @@ msgstr ""
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
-"POT-Creation-Date: 2025-03-20T18:57:16+00:00\n"
+"POT-Creation-Date: 2025-09-23T15:34:25+00:00\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"X-Generator: WP-CLI 2.11.0\n"
"X-Domain: buddypress\n"
@@ -1473,13 +1473,13 @@ msgstr ""
#: bp-activity/classes/class-bp-rest-activity-endpoint.php:1517
#: bp-blogs/classes/class-bp-rest-blogs-endpoint.php:817
#: bp-members/classes/class-bp-rest-members-endpoint.php:1254
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1292
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1346
msgid "Ensure result set includes specific IDs."
msgstr ""
#: bp-activity/classes/class-bp-rest-activity-endpoint.php:1526
#: bp-groups/classes/class-bp-rest-groups-endpoint.php:1434
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1310
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1364
#: bp-messages/classes/class-bp-rest-messages-endpoint.php:1244
#: bp-notifications/classes/class-bp-rest-notifications-endpoint.php:894
msgid "Order sort attribute ascending or descending."
@@ -4425,72 +4425,73 @@ msgstr ""
msgid "You have been unsubscribed."
msgstr ""
-#: bp-core/bp-core-functions.php:4583
+#: bp-core/bp-core-functions.php:4588
msgid "You can change this or any other email notification preferences in your email settings."
msgstr ""
-#: bp-core/bp-core-functions.php:4605
+#: bp-core/bp-core-functions.php:4612
+#: bp-core/bp-core-functions.php:4624
msgid "Go to website's home page."
msgstr ""
-#: bp-core/bp-core-functions.php:5196
+#: bp-core/bp-core-functions.php:5215
msgid "Discover BuddyPress Add-ons"
msgstr ""
-#: bp-core/bp-core-functions.php:5197
+#: bp-core/bp-core-functions.php:5216
msgid "Hello BuddyPress Add-ons!"
msgstr ""
-#: bp-core/bp-core-functions.php:5198
+#: bp-core/bp-core-functions.php:5217
msgid "Add-ons are features as Plugins or Blocks maintained by the BuddyPress development team & hosted on the WordPress.org plugins directory."
msgstr ""
-#: bp-core/bp-core-functions.php:5199
+#: bp-core/bp-core-functions.php:5218
msgid "Thanks to this new tab inside your Dashboard screen to add plugins, you’ll be able to find them faster and eventually contribute to beta features early to give the BuddyPress development team your feedbacks."
msgstr ""
-#: bp-core/bp-core-functions.php:5212
-#: bp-core/bp-core-functions.php:5232
+#: bp-core/bp-core-functions.php:5231
+#: bp-core/bp-core-functions.php:5251
msgid "Get The BP Classic Add-on"
msgstr ""
-#: bp-core/bp-core-functions.php:5213
+#: bp-core/bp-core-functions.php:5232
msgid "Get ready for the brand-new BP Rewrites API!"
msgstr ""
-#: bp-core/bp-core-functions.php:5214
+#: bp-core/bp-core-functions.php:5233
msgid "Our next major version (12.0.0) will introduce several large changes that could be incompatible with your site's configuration. To prevent problems, we've built the BP Classic Add-on, which you may want to proactively install if any of the following cases:"
msgstr ""
-#: bp-core/bp-core-functions.php:5215
+#: bp-core/bp-core-functions.php:5234
msgid "Some of your BuddyPress plugins have not been updated lately."
msgstr ""
-#: bp-core/bp-core-functions.php:5216
+#: bp-core/bp-core-functions.php:5235
msgid "BuddyPress 12.0.0 introduces the BP Rewrites API, which completely changes the way BuddyPress URLs are built and routed. This fundamental change requires most BuddyPress plugins to update how they deal with BuddyPress URLs. If your BuddyPress plugins have not been updated in the last few months, they are probably not ready for BuddyPress 12.0.0."
msgstr ""
-#: bp-core/bp-core-functions.php:5217
+#: bp-core/bp-core-functions.php:5236
msgid "You are still using the BP Default theme."
msgstr ""
-#: bp-core/bp-core-functions.php:5218
+#: bp-core/bp-core-functions.php:5237
msgid "You still use a BP Legacy Widget."
msgstr ""
-#: bp-core/bp-core-functions.php:5219
+#: bp-core/bp-core-functions.php:5238
msgid "If any of the above items are true, we strongly advise you to install and activate the Classic Add-on before updating to BuddyPress 12.0.0."
msgstr ""
-#: bp-core/bp-core-functions.php:5233
+#: bp-core/bp-core-functions.php:5252
msgid "Thank you for installing BuddyPress 12.0!"
msgstr ""
-#: bp-core/bp-core-functions.php:5234
+#: bp-core/bp-core-functions.php:5253
msgid "BuddyPress 12.0 introduces major core changes, overhauling the way that BuddyPress builds and parses URLs."
msgstr ""
-#: bp-core/bp-core-functions.php:5235
+#: bp-core/bp-core-functions.php:5254
msgid "If you find that your site is not working correctly with the new version, try installing the new BP Classic Add-on that adds backwards compatibility for plugins and themes that have not yet been updated to work with BuddyPress 12.0."
msgstr ""
@@ -10257,7 +10258,7 @@ msgid "Identifier for the signup. Can be a signup ID, an email address, or an ac
msgstr ""
#: bp-members/classes/class-bp-rest-signup-endpoint.php:295
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:834
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:845
msgid "Invalid signup id."
msgstr ""
@@ -10283,108 +10284,112 @@ msgstr ""
msgid "Fail to activate the signup."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:797
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:768
+msgid "Invalid activation key format."
+msgstr ""
+
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:808
msgid "Your account has already been activated."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1005
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1059
msgid "Passwords cannot be empty or contain the \"\\\" character."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1056
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1110
msgid "Password for the new user (never included)."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1064
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1118
msgid "The XProfile field data for the new user."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1072
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1126
msgid "The XProfile field ID."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1079
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1133
#: bp-xprofile/classes/class-bp-rest-xprofile-data-endpoint.php:73
msgid "The value(s) (comma separated list of values needs to be used in case of multiple values) for the field data."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1087
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1141
msgid "The visibility for the XProfile field."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1145
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1199
msgid "A unique numeric ID for the signup."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1151
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1205
msgid "The username of the user the signup is for."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1157
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1211
msgid "The email for the user the signup is for."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1163
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1217
msgid "Activation key of the signup."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1169
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1223
msgid "The registered date for the user, in the site's timezone."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1176
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1230
msgid "The registered date for the user, as GMT."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1183
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1237
msgid "The date the activation email was sent to the user, in the site's timezone."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1190
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1244
msgid "The date the activation email was sent to the user, as GMT."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1196
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1250
msgid "The number of times the activation email was sent to the user."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1203
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1257
msgid "The signup meta information"
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1213
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1267
msgid "The new user's full name. (Deprecated)"
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1222
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1276
msgid "Unique site name (slug) of the new user's child site."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1229
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1283
msgid "Title of the new user's child site."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1236
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1290
msgid "Search engine visibility of the new user's site."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1243
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1297
msgid "Language to use for the new user's site."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1276
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1330
msgid "Total number of signups to return."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1284
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1338
msgid "Offset the result set by a specific number of items."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1301
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1355
msgid "Order by a specific parameter (default: signup_id)."
msgstr ""
-#: bp-members/classes/class-bp-rest-signup-endpoint.php:1319
+#: bp-members/classes/class-bp-rest-signup-endpoint.php:1373
msgid "Specific user login to return."
msgstr ""
diff --git Users/cavinsd/Downloads/buddypress-14.3.4/class-buddypress.php Users/cavinsd/Downloads/buddypress-14.4.0/class-buddypress.php
index b9f9357f..6c77545c 100644
--- Users/cavinsd/Downloads/buddypress-14.3.4/class-buddypress.php
+++ Users/cavinsd/Downloads/buddypress-14.4.0/class-buddypress.php
@@ -460,7 +460,7 @@ class BuddyPress {
/** Versions */
- $this->version = '14.3.4';
+ $this->version = '14.4.0';
$this->db_version = 13906;
/** Loading */
diff --git Users/cavinsd/Downloads/buddypress-14.3.4/readme.txt Users/cavinsd/Downloads/buddypress-14.4.0/readme.txt
index 66d5971b..7f72c692 100644
--- Users/cavinsd/Downloads/buddypress-14.3.4/readme.txt
+++ Users/cavinsd/Downloads/buddypress-14.4.0/readme.txt
@@ -6,8 +6,8 @@ License: GNU General Public License v2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
Requires PHP: 5.6
Requires at least: 6.1
-Tested up to: 6.7
-Stable tag: 14.3.4
+Tested up to: 6.8
+Stable tag: 14.4.0
Get together safely, in your own way, in WordPress.
@@ -130,6 +130,9 @@ Try bbPress. It integrates
== Upgrade Notice ==
+= 14.4.0=
+See: https://codex.buddypress.org/releases/version-14-4-0/
+
= 14.3.4 =
See: https://codex.buddypress.org/releases/version-14-3-4/
@@ -214,6 +217,9 @@ See: https://codex.buddypress.org/releases/version-10-0-0/
== Changelog ==
+= 14.4.0 =
+See: https://codex.buddypress.org/releases/version-14-4-0/
+
= 14.3.4 =
See: https://codex.buddypress.org/releases/version-14-3-4/