Security Alert: 26 BuddyDev accounts compromized in brute force attack.

BuddyDev

Search

[Resolved] Additional email address for password recovery purposes

  • Participant
    Level: Enlightened
    Posts: 38
    Javier on May 12, 2016 at 7:38 pm #3839

    Hello!

    I want to create an xProfile field where users can set a new email address (in addition to ‘user_email’) so they can get the password reset message there. Has anyone attempted something similar?

    This is managed by ‘retrieve_password()’ function, which I think is not pluggable. The idea is to send the pass reset message (‘retrieve_password_message’) to that xProfile value, not to ‘user_email’.

    Appreciate any suggestion on this.

    Best,
    Javier

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on May 14, 2016 at 3:55 pm #3866

    Hi Javier,
    do you have the email field setup?

    You can filter on ‘retrieve_password_message’ and send mail right there. After that return empty string and WordPress will not send another email.

    hope that helps.

  • Participant
    Level: Enlightened
    Posts: 38
    Javier on May 14, 2016 at 4:55 pm #3867

    Hi Brajesh,

    Yes I created the field ‘Personal Email’, which is optional, so first I have to check if its empty.

    I couldn’t find out how ‘retrieve_password_message’ manages mail recipient. I hardcoded $user_email with a random address ($user_email = ‘myemail@mysite.com’) just to test, but email’s still reaching WP ‘user_email’ field. (Of course I didn’t use ‘myemail@mysite.com’ but other I have access to).

    Thanks for the feedback.

    • This reply was modified 8 years, 7 months ago by Javier.
  • Keymaster
    Level: Yogi
    (BuddyDev Team)
    Posts: 3115
    Ravi on May 14, 2016 at 7:36 pm #3871

    Hi Javier,

    Please try the following code in your theme functions.php file and let me know it works or not.

    
function buddy_new_reset_password_email( $message, $key, $user_login, $user_data ) {
    
    // get the user data is user object you need to fetch xprofile email value. user $user_data->data->ID to fetch the details
    $user_email = 'ravivats89@gmail.com'; 
    
    if ( is_multisite() ) {
        $blogname = $GLOBALS['current_site']->site_name;
    } else {
        $blogname = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES);
    }
		
    $title = sprintf( __('[%s] Password Reset'), $blogname );
    
    if ( $message && ! wp_mail( $user_email, wp_specialchars_decode( $title ), $message ) )
		wp_die( __('The email could not be sent.') . "<br />\n" . __('Possible reason: your host may have disabled the mail() function.') );
    
    $message = '';
    
    return $message;
}
add_filter('retrieve_password_message','buddy_new_reset_password_email' );

    Thank You
    Ravi

  • Participant
    Level: Enlightened
    Posts: 38
    Javier on May 14, 2016 at 10:29 pm #3878

    Thanks, Ravi.

    Looking really good. I don’t have access to my WP installs here but I’ll check asap and tell you.

    Best,
    Javi

  • Participant
    Level: Enlightened
    Posts: 38
    Javier on May 16, 2016 at 11:22 am #3889

    Hello Ravi,

    This works pretty well, thank you very much!

    Now I need to fetch the xProfile email value and check if its empty. Maybe it would be better to do this outside ‘buddy_new_reset_password_email()’ within another function. I’m not a php black belt, just guessing the smartest way to do this.

    Thank you again,
    Javier

  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on May 16, 2016 at 1:18 pm #3890

    Hi Javier,
    you can replace this line

    

 $user_email = 'ravivats89@gmail.com';

    By following

    
$field_id = "Your email field ID";
$email = xprofile_get_field_data( $field_id, $user_data->id );

if ( !is_email( $email ) ) {
    $email = $user_data->user_email;
}

    That will do it.

  • Participant
    Level: Enlightened
    Posts: 38
    Javier on May 16, 2016 at 5:21 pm #3906

    Hi Brajesh,

    Unfortunately is not working. Some arguments missing:

    
Warning: Missing argument 2 for buddy_new_reset_password_email() [...] on line 3

Warning: Missing argument 3 for buddy_new_reset_password_email() [...] on line 3

Warning: Missing argument 4 for buddy_new_reset_password_email() [...] on line 3

Notice: Undefined variable: user_data in [...] on line 6

Notice: Trying to get property of non-object in [...] on line 6

Notice: Undefined variable: user_data in [...] on line 9

Notice: Trying to get property of non-object in [...] on line 9

Notice: Undefined variable: user_email in [...] on line 20

    Also, I think we need to override $user_email, instead of $email. I turned $email to $user_email, but still getting the missing arguments.

    Thank you for your time,
    Javier

    • This reply was modified 8 years, 7 months ago by Javier.
    • This reply was modified 8 years, 7 months ago by Javier.
    • This reply was modified 8 years, 7 months ago by Javier.
  • Keymaster
    (BuddyDev Team)
    Posts: 24706
    Brajesh Singh on May 16, 2016 at 6:15 pm #3910

    Hi Javier,
    The problem is with this line by Ravi

    
add_filter('retrieve_password_message','buddy_new_reset_password_email' );

    Please change it to

    
add_filter('retrieve_password_message','buddy_new_reset_password_email', 10, 4 );

    That will do it.

  • Participant
    Level: Enlightened
    Posts: 38
    Javier on May 16, 2016 at 6:35 pm #3911

    That really did the trick!

    I was redefining $user_data and $user_login to make things work… I’m not an expert here, as you can clearly see.

    Thank you very much, Brajesh and Ravi.

    All the best,
    Javi

The topic ‘ [Resolved] Additional email address for password recovery purposes’ is closed to new replies.

This topic is: resolved