How to query for users (ID, slug, email, etc...)

[johnjamesjacoby]

Right now, via bbp_parse_query() it's possible to query for users in 3 different ways:

• Numeric ID - ?bbp_user=1
• Nicename Slug - ?bbp_user=admin
• Email Address - ?bbp_user=jjj@bbpress.org

My thoughts:

• ID makes sense, and mirrors WordPress's ?author=1 functionality
• Nicename makes sense, because it is the vanity version of a user's login
• Email address, makes less sense to me, and has the potential to be abused

(Note: Nicename and Email methods require pretty permalinks to be configured for the site bbPress is active on.)

Hat tip glynwintle for the original report.

[johnjamesjacoby]

See also r2917 and #1475. I have a faint memory of talking about this on IRC, and my guess is we concluded that having more explicit queries map to WP_User::get_data_by() was the way to go.

[tharsheblows]

This is a fairly serious privacy issue as email addresses are assumed to be private and being able to search for users via an email address isn't expected. I'd feel much more comfortable treating this as a security issue and fixing the email query issue then discussing the rest. (I patched my live site immediately after reading this.)

[tharsheblows]

don't allow user queries by email address and, if permalinks active, by id

[tharsheblows]

update comment

[netweb]

Agreed, email address here has potential abuse written all over it from a privacy stand point.

As @tharsheblows points out recently on BuddyPress Trac a decision was made to avoid posting "privacy" related issues on Trac and treat them as a security issue, we should do the same.

Original IRC discussion re #1475 ​here

​2828.3.diff refreshes 2828.2.diff with PHPDoc changes.

[johnjamesjacoby]

In 5813:

Users: Remove is_email() check from user query parsing.

This commit removes the ability to load a user profile via their email address. This feature (added in r2917) was a convenience mechanism to make finding a user within the forums with a known address easier, but times have changed and we now consider this to be a privacy concern by default.

Note: this will break backwards-compatibility for installations that may have used this unpublicized (and regrettably unwise) feature.

See #2828. Hat-tip netweb. For 2.6 (trunk)

[johnjamesjacoby]

In 5814:

Users: Remove is_email() check from user query parsing.

This commit removes the ability to load a user profile via their email address. This feature (added in r2917) was a convenience mechanism to make finding a user within the forums with a known address easier, but times have changed and we now consider this to be a privacy concern by default.

Note: this will break backwards-compatibility for installations that may have used this unpublicized (and regrettably unwise) feature.

Fixes #2828. Hat-tip netweb. For 2.5.8 (2.5 branch)