LocalHero Org

Helping Organisations get organised!

Changelog

Part of LH BuddyPress Group Invites
  • 2.1.2: Creating, finding and tidying up users for the invite and registration form now uses the network-wide lh-user-provisioning plugin instead of this plugin’s own copy of that code. An invite sent to a known email alias now finds the person’s existing account instead of creating a duplicate, and users created from a group invite now record where they came from. Users created this way get the unclaimed role with no capabilities, consistently across sites, so they can no longer reach wp-admin. The new-user actions and the “An account has been created” message now only fire when a user really was new.
  • 2.1.1: Completes the 2.1.0 fix: the groups directory is now exempted from lh-membership’s login gate too, so logged-out visitors can browse to a public group in the first place. BuddyPress already hides private and hidden groups from them in the directory.
  • 2.1.0: Fixed the invite-by-email tab being unreachable by logged-out visitors: lh-membership blocks all BuddyPress pages for logged-out visitors by default, and it ran before this plugin’s tab. This plugin now relaxes that check only for public groups’ own pages, excluding the members list and group admin screens, so the tab is reachable again. Private and hidden groups stay closed to visitors.
  • 2.0.1: The anti-bot nonce on the invite and registration form now follows the same pattern as lh-membership: the script’s data attribute is namespaced, and the script fills every form’s hidden nonce field rather than only the first, so pages showing the form more than once work again. The protection itself is unchanged: a soft gate against bots that do not run JavaScript.
  • 2.0.0: Renamed from lh-buddypress-group-registration to lh-buddypress-group-invites, with a full overhaul. The plugin slug, main file, main class, text domain and script file were renamed, and the namespace changed from lh_bgr to lh_bp_group_invites, so every derived option name, meta key, nonce action and hook name changed (for example lh_bgr_http_post_after_user became lh_bp_group_invites_http_post_after_user); external code hooking the old names needs updating. Fixed broken output in the invite form, an unreachable group-creator fallback in get_inviter_id(), an undefined variable in the invited-details shortcode, and wrong text domains that broke translations. Security: the group ID and posted xprofile group IDs are now sanitised, the email input uses sanitize_email(), output is escaped throughout, and the group form message is filtered with wp_kses_post(). Added index.php guards, plugin_name() and plugin_version(), and replaced a readme.txt that had been copied from an unrelated plugin. Open item: logged-out visitors on public groups can trigger account creation for any email address with no verification or rate limiting.
  • 1.00: First release, as lh-buddypress-group-registration.

If you like this plugin please consider making a donation to further development