#1
Without using the
regRequired snippet parameter when performing registration, it appears that WLPE still creates the web user account whether you have defined a username/email address or not! (This occurs when using a simplified registration template using only Name, Email, Username, Password, and TOS)
...What you can end up with is a row in your user table with an empty username and email address, and empty attributes in the attributes table associated to the
invalid record.
IMHO, WebLoginPE should probably account for this scenario out-of-the-box (at a minimum). If the purpose of registration is to register a new user, MODx will *require* the user at least have a username
To fix this, make the following changes in
webloginpe.class.php:
Look for
//<?php - Used for Syntax highlighting only - DO NOT COPY
// Check for required fields.
if ($regRequired !== '')
and change to:
//<?php - Used for Syntax highlighting only - DO NOT COPY
// Check for required fields.
if ($_POST['username'] == '' || empty($_POST['username']) || trim($_POST['username']) == '' ) // pixelchutes
{
return $this->FormatMessage($this->LanguageArray[0]);
}
if ($regRequired !== '')
I understand this can alternatively (and rather easily) be accomplished using the ®Required=`username` parameter, but I’d still like to point out the bug in the snippet is that it can otherwise create an empty record in your user table! This should NOT happen.
#2
I also noticed that when
not using the
®Required=`email` snippet parameter when performing registration, WLPE does not
Validate the email address. So, in the event you wish to make the email field optional, it now means that garbage text can be entered (and stored in the database). IMHO, I think unless the field is empty, email validation should occur whether it is required or not...unless someone can come up with a scenario why you’d optionally capture email but not want the field validated as such.
To perform email validation whether or not the field is required, you can make the following modification:
Look for the line of code below in the
Register() function of
webloginpe.class.php:
//<?php - Used for Syntax highlighting only - DO NOT COPY
if ($regRequired !== '')
And add the following code directly above that line:
//<?php - Used for Syntax highlighting only - DO NOT COPY
if ( strlen($_POST['email']) > 0 ) // pixelchutes
{
// Validate the email address.
$this->ValidateEmail($_POST['email']);
if (!empty($this->Report))
{
return $this->report;
}
}
I also noticed that upon registering a new user, a timestamp was placed into `cachepwd` column of `modx_web_users` table as indicated in the documentation:
http://docs.webloginpe.info/parameters.html See &pruneDays parameter definition.
Quote from: "WebLoginPE
[...] When they log in, the timestamp is deleted. [...]
However, one thing that differs from the documentation is that the timestamp is never deleted upon logging in...
To fix this, make the following changes in
webloginpe.class.php:
Look for
//<?php - Used for Syntax highlighting only - DO NOT COPY
// Flag the account as "Activated" by deleting the timestamp in `cachepwd`
$cacheTimestamp = $modx->db->query("UPDATE ".$web_users." SET `cachepwd`='' WHERE `id`='".$this->User['id']."'");
and change to:
//<?php - Used for Syntax highlighting only - DO NOT COPY
// Flag the account as "Activated" by deleting the timestamp in `cachepwd`
$cacheTimestamp = $modx->db->query("UPDATE ".$web_users." SET `cachepwd`='' WHERE `id`='".$this->User['internalKey']."'"); // pixelchutes I simply changed $this->User[’id’] to
$this->User[’internalKey’]
#4
Let’s say you wanted to prevent Registration from occurring based on some custom dupe-checking rules, you may want to use the
OnBeforeWebSaveUser system event in a custom plugin. In our case, we are sending a unique "Invitation Code" to all users we’d like to invite to use our systems, so we’ll need to ensure that the invitation code they provide has not already been used:
//<?php // Used only for syntax highlighting - Do Not Copy
$e = &$modx->event;
switch( $e->name ){
case 'OnBeforeWebSaveUser':
// Check for previously used invitation key
$sql = $modx->db->select('id', $wlpe->CustomTable, 'invite_key = "'.$modx->db->escape( $_POST['invite_key'] ).'"');
// If found, abort
if( $modx->recordCount( $sql ) > 0 ) {
$wlpe->FormatMessage( 'It appears this invitation key has already been used.' );
return;
}
break;
}
If you haven’t already, be sure to add the WLPE reference to OnBeforeWebSaveUser() $parameters:
//<?php // Used only for syntax highlighting - Do Not Copy
function OnBeforeWebSaveUser($Attributes = array(), $ExtendedFields = array())
{
global $modx;
$parameters = array(
'wlpe' => &$this, // pixelchutes - reference $wlpe instance
'Attributes' => $Attributes,
'ExtendedFields'=> $ExtendedFields
);
$modx->invokeEvent('OnBeforeWebSaveUser', $parameters ); // pixelchutes
}
While the above code effectively pushes an error message into $wlpe->Report, there is no checking in the Register() method for the existence of an error message AFTER the OnBeforeWebSaveUser event has been invoked and BEFORE the "INSERT INTO [...]" SQL is ran. To solve this, make the following modification:
Find the following code:
//<?php // Used only for syntax highlighting - Do Not Copy
// If all that crap checks out, now we can create the account.
$newUser = "INSERT INTO ".$web_users." (`username`, `password`, `cachepwd`) VALUES ('".$username."', '".md5($password)."', '".$cachepwd."')";
And add this condition directly
above it:
<?php // Used only for syntax highlighting - Do Not Copy
if (!empty($this->Report)) // pixelchutes
{
return $this->report;
}
☆ A M B ☆
☆ A M B ☆