dmurphy

Well, I figured it out.

The e-mail address started with a character that was in the authorization pending string. So ltrim() was trimming the first character off the e-mail address. Here’s how I fixed it:

First, in my wp-config.php, I added this line:

define(‘AP_STRING’, ‘ENTER_UNIQUE_STRING_HERE’);
Because of another bug, it’s very important that your unique string is very unique (more on this later). I went to grc.com/pass and grabbed about 8 digits worth of junk.

In the wp-register.php file, change the line that the hack says to change to ‘$user_email=”ap-$user_email”;’ to ‘ $user_email= AP_STRING . “-$user_email”; ‘

Now, go through the hack instructions, and everywhere you find ‘ ltrim( $user_email, “ap-” ); ‘, change it to ‘ substr( $user_email, strlen(AP_STRING)+1); ‘ .

That should do it… unless I forgot something in the instructions.

There is still a flaw here. In the user-edit.php file, the second line that we added, ‘ $checkemailb=explode(“-“,$checkemail); ‘. Has a problem. If somebody’s email address starts with your AP_STRING, then WP thinks they’re still not authorized. You have to authorize them twice, which ends up messing up their email address.

So for now, just come up with a long, very unique AP_STRING. Something like ‘s1n7Thy66’. I guess the long term solution would be to add the AP_STRING at the end of their email, since email@whatever.com-s1n7Thy66 isn’t valid, nobody will have that email address.

Let me know if I forgot anything.