after registering from a referral link the still-anonymous user is shown the standard "User X earned Y points. Total now is Z points." message (called by _userpoints_points_update) on the page telling them a password has been mailed to them.

User A should never be told user B's balance... especially if user A is anonymous.

I also think that the _userpoints_points_update should be invoked after the new user logs in for the first time (having clicked on the link in the registration e-mail) otherwise the system could be very easily abused by referrers on sites that use points as an ecommerce payment method.

Comments

sun’s picture

sun
Primary language German
Location Karlsruhe
commented

I almost completely agree. But we should differentiate between

  • Earning user points for inviting people (invite)
  • Earning user points for referred people visiting the site (user referral)
  • Earning user points for referred people who register at the site (invite)

Some sites might want exactly the third option or a combination of all three.

For the 2nd option there really shouldn't be a notice to a referred (anonymous) visitor. The message could be checked by access rights/user role. Furthermore, it would be neat if this message wasn't shown to the visitor (invitee), but to the inviting user. I think we need the audit log for that.

jredding’s picture

jredding commented
Component: Miscellaneous » Code: referral_points
Status: Active » Closed (fixed)

messages can be turned off in v3.

jredding’s picture

jredding commented
Project: User Points » User Points Contributed modules
Version: 4.7.x-1.x-dev » 5.x-2.0