Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

Activation if already activated

  • Participant
    Level: Master
    Posts: 279
    NikB on May 21, 2019 at 10:22 am #23118

    I’m using BP Registration options to require approval from Admin before a user can access certain areas of the site. This works fine if Admin only issues approval AFTER a user has activated their account, however, Admin approval automatically activates the account which means that if the user attempts to follow the activation link after they have already been approved, it throws an “Invalid Activation Key” error.

    I’m wondering if there is any way of editing activate.php to check if an account has already been activated eg. something like bp_account_was_activated but more like bp_account_is_activated_already in order to offer a more useful message eg. “This step is no longer required as your account is already activated so feel to just go ahead and log in” 😉

    I guess the other option is simply to make it clear to Admin that they must not approve accounts until the user has activated them but it would still be good to have a way of handling this just in csae they forget.

    With many thanks in advance for any thoughts.
    Nikki

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on May 22, 2019 at 10:46 am #23133

    Please modify the activate.php template file in yourtheme/buddypress/members and then modify the text to say that you might have already activated the account.

    There is a function to check if a user account is active

    
bp_is_user_active( $user_id)

    Since you don’t have access to user id, you won’t be able to use it there.

    Regards
    Brajesh

  • Participant
    Level: Master
    Posts: 279
    NikB on May 22, 2019 at 11:42 am #23136

    Thank you as always Brajesh.

    And yes, if I understand you correctly, simply modifying the text on the activate.php to advise that if they have problems they may already be activated is probably a good (and the simplest!) solution.

    Interestingly, looking at the function bp_core_activate_signup, it LOOKS as if it should be checking and returning a different error if ‘The user is already active’ but it’s really not such a critical issue either way for me to try and figure out why that’s not triggering 😉

    Always appreciate your insight and many thanks again.
    Nikki

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on May 23, 2019 at 5:29 pm #23156

    Hi Nikki,
    Thank you.

    It is possible to search by key and check if the user activated account. The problem is this behaviour is configurable and depending on your setup, finding by key may not be available.

    That’s why I suggested the generic approach.

    Regards
    Brajesh

You must be logged in to reply to this topic.

This topic is: not resolved