0

I have user role "b2b_account". I want to prevent user who have role b2b_account to reset their password.

Here my code

add_filter( 'allow_password_reset', 'filter_function_name_2698', 10, 2 );
    function filter_function_name_2698( $allow, $ID ){

        $users = get_users(array(
            'role' => 'b2b_account',
        ));
        foreach($users as $user){
            if($user->ID){

                return false;

                }
            }
    }

I use filter allow_password_reset, but it prevent all user. Thank you for your help.

  • I don't know the filter, but you probably just need to return true if you don't find the user. (And possibly abort immediately if $allow is false?) However there must be better ways of doing this, e.g. look up the user ID we have and see what roles it has rather than fetching all users in the role? – Rup Feb 5 at 9:54
  • Oh, you're also just testing if $user->ID has a value. You're not testing it against $ID – Rup Feb 5 at 9:59
  • Would it work to prevent them from changing their profile altogether? Or do you need to limit it to only password changes? – Josh M Feb 5 at 13:30
  • @JoshM I only prevent when password change only. tq – Baim Quraisy Feb 6 at 1:39
0

Your problems are

  • you're testing if($user->ID){, i.e. does the b2b_account user object we've found have an ID. Which it always will. You probably meant to compare it to $ID.
  • you need to return true in the success case, i.e. after your for loop if you didn't find the user.

However

  • you're ignoring the $allow parameter. You could end with return $allow instead, but it would make more sense to not even do the restricted group check if a previous filter left $allow = false or returned a WP_Error
  • it would make more sense to me to fetch the current groups for the user and see if b2b_account is included, rather than fetch all b2b_account users and check against that list of IDs.

So I'd suggest

add_filter( 'allow_password_reset', 'filter_function_name_2698', 10, 2 );
function filter_function_name_2698( $allow, $ID ) {
    if ( ( ! $allow ) || is_wp_error( $allow ) ) {
         // Rejected by a previous filter
         return $allow;
    }

    // Read the user's roles
    $user_data = get_userdata( $ID );
    if ( $user_data ) {
        $user_roles = $user_data->roles;

        if ( $user_roles && in_array( 'b2b_account', $user_roles, true ) ) {
            // b2b_accounts may not reset passwords
            return false;
        }
    }
    // else user doesn't exist

    return true;
}

(using the role check code from here, plus an extra probably-not-necessary null check)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.