Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

[Resolved] How to Invalidate Email with Spaces in BuddyPress During Registration

  • Participant
    Level: Guru
    Posts: 900
    Tosin on August 10, 2020 at 4:25 pm #32253

    Hello,

    Is it possible to invalidate email address with spaces during buddypress registration. after invalidating it an error message like this should be displayed (Sorry, this email is invalid. Please choose another. Email addresses cannot contain spaces.)

    The problem is my site only enables login by email and password. but when some users register they mistakenly leave a space after their email and buddypress accepts their registration.

    Now after registering and the users are trying to login with the correct email and password but their login fails not knowing that they added a space after their email during registration.

    Thanks

  • Participant
    Level: Guru
    Posts: 900
    Tosin on August 10, 2020 at 4:33 pm #32254

    Also will it be possible to prevent adding of spaces in the email field with the branded login plugin

  • Keymaster
    Level: Yogi
    (BuddyDev Team)
    Posts: 3115
    Ravi on August 10, 2020 at 5:20 pm #32257

    Hello Tosin,

    Thank you for posting. Default email field on BuddyPress Registration page does not allows spaces in it. Please do let me know how you are adding email field on registration page.

    Regards
    Ravi

  • Participant
    Level: Guru
    Posts: 900
    Tosin on August 10, 2020 at 6:19 pm #32266

    Please note that i’m not reffering to spaces in between the email address but after the email address for example

    abcdef@gmail.com&nbsp

    &nbsp refers to the space added

    This problem mainly occurs when a user is registering on a mobile phone and add their email address from google saved email address suggestion after selecting the suggested email a space is added automatically without the user realising this and buddypress accepts the registration with the space after the email.

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on August 10, 2020 at 7:12 pm #32273

    Hi Tosin,
    Are you using anything to override the validation or signup process?

    Otherwise, BuddyPress will strip down any space at the end (It is WordPress that strips it in sanitize_email).

    It is not a BuddyPress issue, Most probably some code or plugin causing it.

    Regards
    Brajesh

  • Participant
    Level: Guru
    Posts: 900
    Tosin on August 10, 2020 at 7:54 pm #32281

    I just deactivated all plugins and noticed that its a login problem and not registration issue wordpress is not allowing logins with spaces after the email address. The error message (invalid email) is being displayed. Will it be possible to display a custom error message in the login form when a user mistakenly adds a space after their email address during login. The custom error message should be (Sorry, this email is invalid. Email addresses cannot contain spaces.) Since the space is invisible the user still thinks that their email address is correct but this custom error message will point out the cause of login failure.

    I am also using the branded login plugin

  • Participant
    Level: Guru
    Posts: 900
    Tosin on August 11, 2020 at 1:00 pm #32293

    I also noticed that this email login issue also occured in the default wordpress login page @ (wp-login.php) after deactivating the branded login plugin.

    Now will it be possible to validate logins with emails and usernames that have spaces at the back in the login form

  • Participant
    Level: Guru
    Posts: 900
    Tosin on August 11, 2020 at 2:00 pm #32295

    After further investigations i’ve found the culprit code below

     /**
 * Email login support for bp-branded-login plugin
 */
add_filter( 'wp_authenticate_user', function( $user ) {

	if ( isset( $_POST['log'] ) && ! is_email( $_POST['log'] ) ) {
		return new WP_Error( 'invalid_email' );
	}

	return $user;
}, 10 );

    Please can this be improved to prevent invalidation of email addresses with spaces at the back

    Thanks

  • Keymaster
    Level: Yogi
    (BuddyDev Team)
    Posts: 3115
    Ravi on August 11, 2020 at 6:11 pm #32296

    Hello Tosin,

    Please try the following code and let me know if works or not

    
/**
 * Email login support for bp-branded-login plugin
 */
add_filter( 'wp_authenticate_user', function( $user ) {

	if ( isset( $_POST['log'] ) && ! is_email( trim( $_POST['log'] ) ) ) {
		return new WP_Error( 'invalid_email', __( 'Please provide a valid email' ) );
	}

	return $user;
}, 10 );

    Regards
    Ravi

  • Participant
    Level: Guru
    Posts: 900
    Tosin on August 11, 2020 at 8:40 pm #32305

    Hello Ravi,

    This problem is now solved the updated code you provided solved the space problem. All my users can now login properly.

    Thank you very much, i’m really grateful

You must be logged in to reply to this topic.

This topic is: resolved