I am submitting a patch to roledelay so that the admin can choose whether the time should start upon registration or when logintoboggan validates. This latter option is necessary when logintoboggan logins after registration with a non-authenticated role -- otherwise spambots could get in simply by waiting after registration and never validating. Adding a simple module_invoke_all is all roledelay needs from logintoboggan.
| Comment | File | Size | Author |
|---|---|---|---|
| #11 | logintoboggan.hook_.patch | 1.24 KB | mfb |
| #10 | logintoboggan.module_17.patch | 680 bytes | mcarbone |
| #3 | logintoboggan.module_16.patch | 579 bytes | mcarbone |
| logintoboggan.module_15.patch | 581 bytes | mcarbone |
Comments
Comment #1
Gary Feldman commentedNotwithstanding the function being called logintoboggan_validate_email, it feels like the operation here should be called update, and not validate. That would seem more consistent with the operator usage for hook_user.
This also feels very specific. Isn't the hole closed if you disallow immediate login?
Comment #2
mcarbone commentedThat would close the hole, but then it wouldn't allow immediate log in, which is a popular option, I think. Should I resubmit with your suggested change in terminology?
Comment #3
mcarbone commentedPatch modified to use 'update' as the hook op rather than 'validate.'
Comment #4
hunmonk commentedare we sure we want to use a structure similar to hook_user? i'm wondering if a specific hook name w/o the $op arg would be better in this case or not. thoughts?
Comment #5
Gary Feldman commentedFor that matter, would it work to just invoke the existing hook_user mechanism with the 'update' $op? At an abstract level, it makes sense to say that hook_user('update',.. should be called any time a user account is changed, and this is certain such a case.
Comment #6
hunmonk commented+1. i like that approach much better. user module is a required core module, so invoking a user module hook in LT should always work.
Comment #7
p_palmer commenteddo you have a patch for comment #5 or #6 ?
Comment #8
mcarbone commentedI'd be happy to implement the change as recommended in #5, but then I need a bit of advice: where would be the proper place to store the information that the update is LT-related specifically? For the purpose I described above (roledelay being alerted when verification is done), I would need to know that information above and beyond the fact that the user has been updated.
Comment #9
hunmonk commentedcan't you add something to the $user object before you invoke the hook?
$user->logintoboggan_email_validated = TRUE;
something like that, maybe?
there might be a better way to do it. just thinking out loud...
Comment #10
mcarbone commentedOK, implemented the change suggested in comment #5 with hunmonk's suggestion.
Comment #11
mfbHere's the same patch for drupal 5 branch.
Comment #12
dgtlmoon commentedI tested patch from #10 and it worked fine on latest 4.7.
im guessing $account->logintoboggan_email_validated only is set when they validate as this is not placed as a saved user variable
Comment #13
hunmonk commentedcorrect. we're not even putting that variable into the global user object, so it's only really available to modules making use of the 'update' op of hook_user. i like it being this insulated.
i do have a few minor concerns about the current patch:
perhaps we should also put logintoboggan_email_validated into the $edit array as opposed to the user object?? not sure about that, just speculating...
thoughts on these?
Comment #14
mcarbone commented1) It works either way, and either way, the module taking advantage of the extra data will have to inspect the code to know what to look for.
2) The only alternative I can think of is to fill the $edit variable, which is sort of ridiculous. Or we go back to something like the original patch, with logintoboggan making its own hook -- then we don't have to worry about adding a new interpretation of what a hook_user 'update' means.
Comment #15
hunmonk commentedcommitted to drupal 5 and HEAD. i won't add this to 4.7, as it's a feature and not a bugfix.
Comment #16
(not verified) commented