bug report
-
We have an unusual behaviour when activating a users account, the account activated email they receive contains the admins email as the account email and the admin user name as the account user name. But worst of all, the password reset link is a password reset link for the admins account, posing a significant security risk. A new user was able to reset the admins password using this malformed account activated email.
This is for ultimate member 2.3.10
-
We are using the basic email shotcodes as below but the
{email} returns the administrator email and
{username} returns the administrator username
{password_reset_link} includes a link to reset the administrator password
Account Information Your account e-mail: {email} Your account username: {username} Set your password: {password_reset_link}Have you activated the “Email sending by Action Scheduler”
at UM Settings -> Advanced -> Features?No. That feature is not enabled.
Try to do a Theme/Plugin conflict test if your Theme
or another Plugin or a custom code snippet is causing a conflict with UM.https://docs.ultimatemember.com/article/96-how-to-do-a-plugin-theme-conflict-test
I haven’t been able to identify any conflicts through disabling plugins. admin info is included in any email of accounts that require manual approval .
Are there any specific hooks ultimate member uses that I could use to override the data sent in the approval emails? It seems the plugin must be doing something like get current user data to populate the emails rather than the approved user id
This is a massive security risk and we cannot approve accounts until it is resolved. Issue
You can try this code snippet
add_action( 'um_before_email_notification_sending', 'um_before_email_notification_sending_user_id_fix', 999, 3 ); function um_before_email_notification_sending_user_id_fix( $email, $template, $args ) { $user = get_user_by( 'email', $email ); um_fetch_user( $user->ID ); }Edit: changed priority to 999
-
This reply was modified 11 months, 2 weeks ago by
missveronica.
-
This reply was modified 11 months, 2 weeks ago by
missveronica.
Excellent, this code snippet worked. Test account did not have admin details just the correct user info
add_action( ‘um_before_email_notification_sending’, ‘um_before_email_notification_sending_user_id_fix’, 999, 3 ); function um_before_email_notification_sending_user_id_fix( $email, $template, $args ) { $user = get_user_by( ’email’, $email ); um_fetch_user( $user->ID ); }Thank you for your help!
Hi there,
I have the same problem in e-mails with UM 2.10.4. The snippet doesn`t help me. We are using the placeholders for first_name and last_name.
If you need support for the free Ultimate Member plugin
then per the Forum guidelines please start your own topic at
https://wordpress.org/support/plugin/ultimate-member/#new-postHello, unfortunately this issue isn’t resolved in 2.10.5
End users are still getting admin details in their account approval emails.Just to add. the temporary code snippet fix missveronicatv supplied still works
Please start your own topic at
https://wordpress.org/support/plugin/ultimate-member/#new-postHi @biotrace
I hope I’m not bothering you, but could you please check how the recent 2.10.5 version works without the extra code snippet from @missveronicatv. We’re just looking to confirm that the core email notifications work as expected out of the box..
P.S. @missveronicatv thank you for your help and for suggesting the hotfix before the 2.10.5 release.
Best Regards!Hello, it’s no bother at all. Yes I was able to test the plugin back when 2.10.5 was released a few weeks back and unfortunately the admin info was still being leaked in the approval emails without the code snippet fix active, but thankfully the code snippet fix is still working for the current version, so it’s still a valid temporary fix.I have included my site health info links below in a hope they can assist you.
ges———————————————————————Pages
- User: User (ID#950) | https://biotrace.co.nz/user/
- Login: Login (ID#952) | https://biotrace.co.nz/login/
- Register: Register (ID#954) | https://biotrace.co.nz/register/
- Members: Members (ID#956) | https://biotrace.co.nz/members/
- Logout: Logout (ID#958) | https://biotrace.co.nz/logout/
- Account: Account (ID#960) | https://biotrace.co.nz/account/
- Password Reset: Password Reset (ID#962) | https://biotrace.co.nz/password-reset/
- Newsletters unsubscribe: Sample Page (ID#2) | https://biotrace.co.nz/sample-page/
Hi @biotrace
For some reason, I’m unable to see the registration form on the predefined page selected in the Ultimate Member settings:
https://jam.dev/c/2036e18d-1d06-4f66-bf65-3292546da6ca
The same applies to the Users page. I found a working registration form here. Account Application – BioTrace and tested it; it appears to work without requiring admin review.
Unfortunately, just the list of predefined pages isn’t enough to fully investigate the issue. Could you please share your Site Health information? More information about Site health you can find here.
Please provide any additional details that might help us move forward.
Best Regards! -
This reply was modified 11 months, 2 weeks ago by
The topic ‘bug report’ is closed to new replies.