Some of the plugin code needs fixing – it disables registration anti-spam

redsand
(@redsand)

8 years, 12 months ago

Hi Josh,

I found some code in your plugin that needs a bit of fixing. (I’m another plugin developer.)

Line 51:

add_action( 'register_post', array( $this, 'create_new_user' ), 10, 3 );

Please see the documentation for the register_post hook.

From the documentation:

This action hook can be used to handle post data from a user registration before the registration_errors filter is called or errors are returned.

Please note that this hook should never be used for custom validation. Any custom validation rules should be performed using the registration_errors filter.

The effect of doing this is that you will end up bypassing any other registration anti-spam plugins, and add a new user into WordPress even if the user registration is blocked by another plugin.

You’re creating a new user before errors can be processed by WordPress, thereby negating any error processing. (See above.)

So, as it stands, your plugin is actually increasing the amount of registration spam people are getting.

This isn’t the right place to be hooking into the code, and I would recommend not adding a new user manually, and instead letting WordPress do it.

My intent isn’t to criticize your work so I hope this isn’t seen that way. I hope this will help you fix the issue, and help improve your plugin to make it better for your users.

– Scott

https://wordpress.org/plugins/new-user-approve/

Viewing 4 replies - 1 through 4 (of 4 total)

Thread Starter redsand
(@redsand)

8 years, 9 months ago

I noticed that this issue still isn’t resolved. Do you have any plans to fix this? It’s not exactly a small issue.

Thread Starter redsand
(@redsand)

8 years, 7 months ago

I was hoping that you would respond to this support request or fix the issue by now as I posted this months ago. I’m working on some corrected to give an example of what it should look like. I’ll post here as soon as I can.
Thread Starter redsand
(@redsand)

8 years, 7 months ago
To fix the plugin, the following changes will do the trick. It may need further tweaking to dial it in the way you like, but this is a quick and dirty version. However it will work without errors, and allow other plugins hooked into the ‘registration_errors’ filter hook (such as registration anti-spam plugins, CAPTCHAs, etc) to function properly.

The only file you need to edit is the main plugin file, ‘new-user-approve.php’.

To start, delete line 51:
```
add_action( 'register_post', array( $this, 'create_new_user' ), 10, 3 );
```
We’re going to re-add this later on.

Change line 63 from:
```
add_filter( 'registration_errors', array( $this, 'show_user_pending_message' ) );
```
to:
```
add_filter( 'registration_errors', array( $this, 'show_user_pending_message' ), 9999, 3 );
```
This will change your show_user_pending_message() function from firing at priority 10 (early/middle) to firing at the end of the lineup and allow it to pass 3 arguments instead of 1. It’s important that it fires at the end.

Next, we need to make some minor edits to the create_new_user() function.

On lines 445-448, change it from:
```
public function create_new_user( $user_login, $user_email, $errors ) {
	if ( $errors->get_error_code() ) {
		return;
	}
```
to:
```
public function create_new_user( $errors, $user_login, $user_email ) {
	if ( $errors->get_error_code() ) {
		return $errors;
	}
```
Then add this after line 455:
```
return $errors;
```
Change line 594 from this:
```
public function show_user_pending_message( $errors ) {
```
to:
```
public function show_user_pending_message( $errors, $user_login, $user_email ) {
```
After line 599, add this:
```
$this->create_new_user( $errors, $user_login, $user_email );
```
Done. Now your plugin will play well with others. Hope that helps!
adambradford
(@adambradford)

8 years ago

Did this ever get fixed? I don’t want to use the plugin if it didn’t.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Some of the plugin code needs fixing – it disables registration anti-spam’ is closed to new replies.

Tags