2

I've followed instructions found on this site and elsewhere on the internet intended to let me give certain people a registration link that will let them sign up with a specific user role.

The user role I want to give to some, but not all people, is a custom one called "unmonitored". I have it working by adding this code to my functions.php file:

    // signup stuff
    add_action('register_form','show_role_field');
    function show_role_field(){ ?>
    <input id="role" type="hidden" tabindex="20" size="25" value= "<?php if (isset($_GET['role'])) {echo $_GET['role'];} ?>"  name="role"/>
    <?php
    }

    add_action('user_register', 'register_role');

    function register_role($user_id, $password="", $meta=array()) {

       $userdata = array();
       $userdata['ID'] = $user_id;
       $userdata['role'] = $_POST['role'];

       //only allow if user role is my_role

       if ($userdata['role'] == "unmonitored"){
          wp_update_user($userdata);
       }
    }

This means that if someone registers at www.[mywebsiteurl].com/wp-login.php?action=register&role=unmonitored they are given the user role "unmonitored" - which is perfect.

But the problem is that if they mess up their registration by entering an email address that has already been taken or mis-typing their invitation code (I'm using a plugin called Easy Invitation Codes http://wordpress.org/plugins/baw-invitation-codes/) they are presented with an error on www.[mywebsiteurl].com/wp-login.php?action=register - the crucial &role=unmonitored disappears from the URL, the user completes their registration and they get assigned the default user role instead of the "unmonitored" one I need them to have.

Can anyone help me stop the error page stripping &role=unmonitored from the URL?

Happy to give any code needed, apologies if I've omitted any info - not yet hugely familiar with this side of Wordpress.

0

This is an easy fix by simply using $_REQUEST instead of $_GET in your hidden field for register_form. More importantly, you should be sanitizing the field before you echo it, otherwise you're wide open to injection and CSRF:

 <?php if ( isset( $_REQUEST['role'] ) ) echo esc_attr( $_REQUEST['role'] ) ?>
  • Thank you so much! Works perfectly. I'll have to read up on this sanitation business. – Wilf Apr 3 '14 at 10:51
  • No worries. Seriously, do it! Like, before you do/learn anything else! – TheDeadMedic Apr 3 '14 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.