#2780 closed defect (bug) (fixed)
Users cannot confirm/dismiss email address changes on multisite
| Reported by: |
|
Owned by: |
|
|---|---|---|---|
| Milestone: | 2.6 | Priority: | high |
| Severity: | normal | Version: | 2.0 |
| Component: | Component - Users | Keywords: | |
| Cc: |
Description
When porting the WordPress user profile and edit_user() code over, the multisite-only email-address confirmation bits were also ported, but incorrectly.
It looks like because bbp_edit_user_handler() is hooked to the bbp_post_request action, the $_GET conditions will never have the chance to happen.
BuddyPress has already ported this multisite-only functionality to be always-on, even for single-site installations, and I believe it is wise for bbPress to do the same because most users performing this action are "untrusted" community members vs. "trusted" members with full wp-admin access to directly manipulate user data, even if it is their own.
Roadmap to repairing this for 2.6:
$_GETchecks into their own function, hooked tobbp_get_requestsend_confirmation_on_profile_email()function