prevent users from changing their email address

Question

does anybody know how to hook or filter the user-edit.php file so that an user's email address is disabled from editing akin to how the username is disabled ..??..

i can edit the core file (gasp) and include disabled="disabled" in the form and this works but i'm at a loss as to how to add the disable via hook or filter ..

i can also run a function like this that hides the email address via css

/* Change WordPress dashboard CSS */
function custom_admin_styles() {
echo '<style type="text/css">#email { display: none !important; }</style>';
}
add_action('admin_head', 'custom_admin_styles');

but that pulls out the whole email thus form looks funny and then i believe that with a DOM Editor like Firebug, one can still access that email field thus change it ... ugh ...

ideally, i would like to replace this entire user-edit.php code from this ->

<label for="email"><?php _e('E-mail'); ?> <span class="description"><?php _e('(required)'); ?></span></label></th><td><input type="text" name="email" id="email" value="<?php echo esc_attr($profileuser->user_email) ?>" disabled="disabled" class="regular-text" /> <span class="description"><?php _e('Emails cannot be changed.'); ?></span>

to something like this ->

<label for="email"><?php _e('E-mail'); ?> </label></th><td><?php echo esc_attr($profileuser->user_email) ?>" Please Contact Tech support to change your email

thanks in advance for any pointers you can share ... cordially, chuck scott

Answer 1

The only correct solution

(Other answers I see are faulty, vulnerable or incomplete. All of them can be bypassed.)

This plugin does correctly:

class DisableMailChange
{

    public function __construct()
    {
        //prevent email change
        add_action( 'personal_options_update',  [$this, 'disable_mail_change_BACKEND'], 5  );
        add_action( 'show_user_profile',        [$this, 'disable_mail_change_HTML']  ); 
    }

    public function disable_mail_change_BACKEND($user_id) {
        if ( !current_user_can( 'manage_options' ) ) { 
            $user = get_user_by('id', $user_id ); $_POST['email']=$user->user_email; 
        } 
    }

    public function disable_mail_change_HTML($user) {
        if ( !current_user_can( 'manage_options' ) ) { 
            echo '<script>document.getElementById("email").setAttribute("disabled","disabled");</script>';
        } 
    }
}
new DisableMailChange();

Answer 2

Not exact answer, but to prevent email change (actual change, not field edit) you could tweak around this action:

add_action( 'user_profile_update_errors', 'prevent_email_change', 10, 3 );

function prevent_email_change( $errors, $update, $user ) {

    $old = get_user_by('id', $user->ID);

    if( $user->user_email != $old->user_email   && (!current_user_can('create_users')) )
            $user->user_email = $old->user_email;
}

Answer 3

Dirty hack, feel free to modify.

Only admins or users with edit_users cap "can change" email, others can't.

Theme functions.php:

class Edit_Email {
    function start() {
        ob_start();
    }

    function footer() {
        $content = ob_get_contents();

        ob_end_clean();

        $this->replace( $content );

        echo $content;
    }

    function replace( &$content ) {
        $pattern = array(
            '/E-mail <span.+?<\/span>/',
            '/<input type="text"(.*?)value="(\\S+@\\S+\\.\\w+)[^>]*\/>/'
        );

        $replacement = array(
            'E-mail',
            '<input type="hidden"\1value="\2" /> \2 Please Contact Tech support to change your email.'
        );

        $content = preg_replace( $pattern, $replacement, $content );
    }
}

if ( ! current_user_can( 'edit_users' ) && ( $pagenow == 'profile.php' ) ) :
    $edit_email = new Edit_Email();
    $edit_email->start();

    add_action( 'admin_footer', array( &$edit_email, 'footer' ) );
endif;

Answer 4

In addition to Rarst's answer:

To prevent email change server side

add_action( 'user_profile_update_errors', 'prevent_email_change', 10, 3 );

function prevent_email_change( $errors, $update, $user ) {

    $old = get_user_by('id', $user->ID);

    if( $user->user_email != $old->user_email   && (!current_user_can('create_users')) )
            $user->user_email = $old->user_email;
}

To disable WordPress user email profile fields

add_action('admin_init', 'user_profile_fields_disable');

function user_profile_fields_disable() {

    global $pagenow;

    // apply only to user profile or user edit pages
    if ($pagenow!=='profile.php' && $pagenow!=='user-edit.php') {
        return;
    }

    // do not change anything for the administrator
    if (current_user_can('administrator')) {
        return;
    }

    add_action( 'admin_footer', 'user_profile_fields_disable_js' );

}

function user_profile_fields_disable_js() {
?>
    <script>
        jQuery(document).ready( function($) {
            var fields_to_disable = ['email'];
            for(i=0; i<fields_to_disable.length; i++) {
                if ( $('#'+ fields_to_disable[i]).length ) {
                    $('#'+ fields_to_disable[i]).attr("disabled");
                    $('#'+ fields_to_disable[i]).after("<span class=\"description\"> " + fields_to_disable[i] + " cannot be changed.</span>");
                }
            }
        });
    </script>
<?php
}

Resources

https://www.role-editor.com/hide-disable-wordpress-user-profile-fields/

Answer 5

You can use JQuery to disable the email (and any other fields in the edit profile page).

For example, something like this in a plugin:

  //Disables certain fields (email, password) in WP Admin edit user page (user-edit.php)
   global $pagenow;
   if ( $pagenow == 'user-edit.php' ) {
        add_action( 'admin_footer', 'disable_userprofile_fields' );
   }

    /**
    * Disables certain fields (email, password) in WP Admin edit user page (user-edit.php)
    */
    function disable_userprofile_fields() {
    ?>
        <script>
            jQuery(document).ready( function($) {
                if ( $('input[name=email]').length ) {
                    $('input[name=email]').attr("disabled", "disabled");
                }
                if ( $('input[name=pass1]').length ) {
                    $('input[name=pass1]').attr("disabled", "disabled");
                }
                if ( $('input[name=pass2]').length ) {
                    $('input[name=pass2]').attr("disabled", "disabled");
                }
            });
        </script>
    <?php
    }

Answer 6

This should do it:

    add_action( 'personal_options_update', 'disable_email_change_back'); // own profile
    add_action( 'edit_user_profile_update', 'disable_email_change_back'); // others profiles
    function disable_email_change_back($user_id) {
        $user = get_user_by('ID', $user_id);
        $_POST['email'] = $user->user_email;
    }
    
    add_action( 'show_user_profile', 'disable_email_change_front'); // own profile
    add_action( 'edit_user_profile', 'disable_email_change_front'); // others profiles
    function disable_email_change_front($profileuser) {
        echo '<script>document.getElementById("email").setAttribute("disabled","disabled");</script>';
    }

Answer 7

The hack given below has been tested with WordPress 3.1.

Open user-edit.php, find:

<th><label for="email"><?php _e('E-mail'); ?> <span class="description"><?php _e('(required)'); ?></span></label></th>
<td><input type="text" name="email" id="email" value="<?php echo esc_attr($profileuser->user_email) ?>" class="regular-text" /></span>

and replace with:

<th><label for="email"><?php _e('E-mail'); ?> <span class="description"></span></label></th>
<td><input type="hidden" name="email" id="email" value="<?php echo esc_attr($profileuser->user_email) ?>" class="regular-text" /><?php echo esc_attr($profileuser->user_email) ?></span>

It is just a workaround that visually removes the ability to change email addresses, not actually disable the feature.