Skip to content

Fix two activation bugs in bp_core_activate_signup()#4899

Open
GaryJones wants to merge 1 commit intobuddyboss:releasefrom
GaryJones:fix/activation-xprofile-data-and-status-check
Open

Fix two activation bugs in bp_core_activate_signup()#4899
GaryJones wants to merge 1 commit intobuddyboss:releasefrom
GaryJones:fix/activation-xprofile-data-and-status-check

Conversation

@GaryJones
Copy link
Copy Markdown

Problem

bp_core_activate_signup() in bp-members/bp-members-functions.php has two related bugs that cause activation failures and data loss during user registration.

1. Xprofile data lost for backcompat-created users

When a user is pre-created by BP_Signup::add_backcompat(), the $user_already_created flag is set and the function returns early. The xprofile data persistence block sits after this early return, so profile field data from signup meta is silently discarded. Users complete registration with all their custom profile fields, but the data never makes it into the xprofile tables.

The fix moves the xprofile data block to before the $user_already_created early return, so the data is saved regardless of how the user was created.

2. False activation failure when user_status is already 0

The function treats zero affected rows from UPDATE ... SET user_status = 0 as an activation error and returns WP_Error('invalid_key'). However, wp_update_user() can run during registration and reset user_status to 0 before activation occurs. When this happens, the UPDATE is a no-op (the value is already 0), $wpdb->query() returns 0, and the user receives an "Invalid activation key" error despite having a perfectly valid key.

Since the activation key has already been validated by this point in the function, zero affected rows is not an error — the user is legitimate either way. The fix removes the return-value check from the query.

Test plan

  • Register a new user with custom xprofile fields filled in
  • Activate the account and verify the xprofile data is present on their profile
  • Test activation where user_status is already 0 (e.g. because a plugin called wp_update_user() during registration) — should succeed instead of returning "Invalid activation key"
  • Verify normal activation flow (where user_status is non-zero) still works correctly

1. Move xprofile data persistence before the $user_already_created
early return, ensuring profile field data from signup meta is saved
even when the user was pre-created by BP_Signup::add_backcompat().

2. Stop treating zero affected rows from the user_status UPDATE as
an activation failure. When wp_update_user() runs during registration
it can reset user_status to 0 before activation, making the UPDATE
a no-op. Since the activation key has already been validated, zero
affected rows is not an error.
@welcome
Copy link
Copy Markdown

welcome bot commented Mar 2, 2026

Thanks for your pull request. It looks like this may be your first contribution to the BuddyBoss Platform open source project. Please note that this project and all contributions to it are public and bounded by the GPL v2.0 license, and that a record of the contribution (including all personal information you submit with it, including your full name and email address) is maintained indefinitely and may be redistributed with this project. If you are not okay with these terms, please close this pull request. Alternatively, you can let us know about your concerns by adding a comment to this pull request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants