Simple Membership . Password empty or invalid

[pennymachines]

Hi!

Despite your updates, I still see an incompatibility logon issue with w3all WP phpBB integration (version 3.0.4) and the Simple Membership plugin (version 4.7.6) on my multisite.

The issue:
A new user is created using the Simple Membership registration form.
("Enable Auto Login After Registration" is activated in Simple Membership Settings/Advanced)

But the new user is not auto-logged on. The new user sees a login form with the dreaded "Password empty or invalid" message. If they try to log on using this form (Simple Membership's Member Logon form), they get the same message.
If they use my Wordpress logon modal, they can log on successfully.

I tested extensively yesterday to trace the cause (deactivated all plugins, reverted to default theme etc.). The bug only disappears when I deactivate w3all WP phpBB.
With w3all WP phpBB deactivated, the new user is automatically logged on after submitting the registration form.

Attached is the Simple Membership bug log for registrations with and without w3all WP phpBB activated, and a screen grab of SWPM's logon form after auto logon fails.

[axew3]

Hi David! It is long time the plugin code have been leaved alone to himself and i did not updated it by long time.
It should receive a deep clean up and simplification and it will be done soon.
The admin page will be rewrite within all the core files.
Many not useful things will be removed and many other changed from scratch.

Anyway about the bug on simple membership you report i will take a look into asap.
You did not understand why it happen?

[axew3]

Reversed the mess.
The integration code run fine, but as said on prev post...

Ok let see what i reversed and explain the issue how it happen and how to fix:

-An user register, i activated simple membership free subscription, and autologin then the user goes through
https://127.0.0.1/wpxphpbb4/membership- ... istration/
to register.
I logged the code using error_log(var_export($my_array, true)); somewhere into hooks to detect where the problem could come out while executing registration tests.

What happen? the flow

First of all after the user is created by SM it fire

Code: Select all

 add_action( 'user_register', 'wp_w3all_phpbb_registration_save', 10, 1 );

that so go to fire the related function wp_w3all_phpbb_registration_save into file functions.php
which call the method

Code: Select all

WP_w3all_phpbb::create_phpBB_user_res($wpu); 

of the class WP_w3all_phpbb on file class.wp.w3all-phpbb.php

and this is the problem.

The private static function create_phpBB_user($wpu, $action = ''){

first of all, it do not add the user if

Add users in phpBB only after first successful login in WordPress into plugin integration admin it is set to YES.
That's obvious need to be set to NO in this case.

Then, the function code follow adding the user into phpBB, until there is this long comment:

Code: Select all

  // FIX AUTOLOGIN for woocommerce or any other plugin:
  // when user registered and need to be logged in automatically, then avoid to follow without phpBB session setup
  // or since the phpBB cookie is not released at this point, when verify_credentials will fire, the user will be logged out
  // add any other here, ex:
  // for any: if ( $w3all_phpbb_user_deactivated_yn != 1 && !current_user_can( 'create_users' ) )
  // that check both if the user need to be logged in, because it is not an admin creating users
  // or: if ( class_exists('WooCommerce') OR isset($_POST['createaccount']) OR class_exists('somethingelse') ) {

so himself and by default the function do not exec the subsequent

Code: Select all

 if ( class_exists('WooCommerce') && $w3all_phpbb_user_deactivated_yn != 1 && !current_user_can('create_users') )
 { // or may restrict more based on if some $_POST var exist or not
     if( ! defined("PHPBBAUTHCOOKIEREL") ){
      self::phpBB_user_session_set_res($wpu);
    }
 }

because it fire self::phpBB_user_session_set_res($wpu); setting the related phpBB user session, only if the IF above is satisfied or will not set the phpBB user session, then the auto login fail.

To make it easy so just after the comment, or the woocommerce snippet we add this to fix , maybe, but there are more ways that actually i do not well focus because i should dive into more that are about to fix the issue before it happen, or later into the stack, or changing some easy somewhere else

Code: Select all

# Available vars to check that we are on Simple Memberships action
# 'swpm_registration_submit'  'swpm_membership_level'  'swpm_level_hash' 
# and maybe 'level_identifier'

 if( isset($_POST['swpm_registration_submit']) && isset($_POST['password']) )
 {
   if( wp_check_password($_POST['password'], $wpu->user_pass, $wpu->ID) )
    {
      self::phpBB_user_session_set_res($wpu);
      wp_safe_redirect( home_url() );
      exit;
    }
 }

if into the snippet above we do not add

Code: Select all

wp_safe_redirect( home_url() );
exit;

(and the redirect can be to anything else, any other page) but if we do not add a redirect the user will be/is logged in, but the screen will fall into

Auto login nonce verification check failed!

and/but if the user then navigate to the front end or profile will result anyway logged in.

To fix this we should see what it happen with the nonce, which part i still did not go deep to see.
It is already used by SM and result so not valid?
Is it missed somewhere? Should not, i prepend for the first but maybe i am wrong.

[pennymachines]

Hi Alessio!

I'm glad to hear you're still supporting the plugin.

I'm afraid I can't offer any helpful ideas about the cause of this issue, beyond my message above.

I had suspected a possible password encoding mismatch:

Looking at the function that builds the auto-login URL after registration, there's a telling asymmetry:
php'swpm_user_name' => urlencode($user_data['user_name']),
'swpm_encoded_pw' => $encoded_pass, // ← NOT urlencoded
The username is explicitly urlencode()'d before being placed in the URL. The base64-encoded password is not.

But I tested this. I turned off "Force Strong Password for Members" in Simple Membership and made a test registration with password: asdfghjk (no uppercase, numbers or special characters) but it made no difference. Still no auto logon.

Another problem which might be instructive...

With w3all WP phpBB integration activated, once a user is logged on, they cannot log out using ?swpm-logout=true
With w3all WP phpBB integration activated, once a user is logged on, they can log out using wp-login.php?action=logout
With w3all WP phpBB integration deactivated, once a user is logged on, they can log out using ?swpm-logout=true but if they tried to log out using wp-login.php?action=logout they would get this prompt: "You are attempting to log out of Subsite1 Do you really want to log out?" with log out link to /wp-login.php?action=logout&_wpnonce=b3495850b4 Clicking that link would not log out user.

PS - I posted the above before seeing your message above. I will now read them...

[pennymachines]

OK, so having now read your message I'm more confused...

I looked in class.wp.w3all-phpbb.php for the lines:

Code: Select all

wp_safe_redirect( home_url() );
      exit;

but they were not there. So I added them, cleared caches etc. and tested registration, but nothing changed.

"Add users in phpBB only after first successful login in WordPress" is set to NO

[axew3]

No look, as said above, you have to open the file /wp-w3all-phpbb-integration/class.wp.w3all-phpbb.php
and search for the commented lines that starts with

Code: Select all

// FIX AUTOLOGIN for woocommerce or any other plugin:

and you have to ADD after these commented lines this exact code

Code: Select all

# Available vars to check that we are on Simple Memberships action
# 'swpm_registration_submit'  'swpm_membership_level'  'swpm_level_hash' 
# and maybe 'level_identifier'

 if( isset($_POST['swpm_registration_submit']) && isset($_POST['password']) )
 {
   if( wp_check_password($_POST['password'], $wpu->user_pass, $wpu->ID) )
    {
      self::phpBB_user_session_set_res($wpu);
      wp_safe_redirect( home_url() );
      exit;
    }
 }

This fix the issue about autologin in Simple Memberships.

The logout seem a problem related to the fact that the phpBB login cookie and session is not deleted when the SM logout occur, so the user keep logged in. I did not checked but obviously this is the problem.