Files
unsupervised-scheduler/templates/frontend/register-page.php
T
thatguygriffandClaude Fable 5 681fc5ae07
CI / Tests (PHP 8.1) (pull_request) Successful in 43s
CI / Tests (PHP 8.2) (pull_request) Successful in 37s
CI / PHPStan (pull_request) Successful in 2m45s
CI / Build Plugin Zip (pull_request) Skipped
CI / No Debug Code (pull_request) Successful in 2s
CI / Coding Standards (pull_request) Successful in 2m49s
CI / Tests (PHP 8.3) (pull_request) Successful in 2m42s
Lock the registration email to the invite only when the invite is redeemable
The register form keyed the read-only, prefilled email off any invite row
matching the token. A stale token (expired / accepted / revoked) with open
registration on therefore showed the stale invite's address read-only while
the submit handler took the open branch and required a posted email the
locked field never submits, dead-ending the form. The lock now applies
exactly when the invite is acceptable; otherwise the editable field renders.

Closes #78

Co-Authored-By: Claude Fable 5 <[email protected]>
2026-07-22 10:24:44 -03:00

88 lines
5.0 KiB
PHP

<?php
declare(strict_types=1);
if (! defined('ABSPATH')) {
exit;
}
/**
* @var \Unsupervised\Schedular\Auth\Invite|null $invite
* @var bool $inviteValid Whether $invite can still be redeemed — only then is the email fixed.
* @var string $token Raw invite token from the request (only its hash is stored).
* @var bool $canRegister
* @var bool $open Whether open (self-approval) registration is enabled.
* @var string $successType '' | 'invite' (created + logged in) | 'confirm' (check email).
* @var string $confirmResult '' | '1' (email confirmed) | 'expired'.
* @var string $loginUrl Where the post-confirmation sign-in link points.
* @var string $error
* @var list<array{policy: \Unsupervised\Schedular\Policy\Policy, version: \Unsupervised\Schedular\Policy\PolicyVersion}> $policyForms
*/
?>
<div class="us-register-form">
<?php if ($successType === 'invite') : ?>
<p class="us-success"><?php esc_html_e('Your account has been created and you are now logged in.', 'unsupervised-schedular'); ?></p>
<?php elseif ($successType === 'confirm') : ?>
<p class="us-success"><?php esc_html_e('Your account has been created. Check your email for a link to confirm your address — once you do, a studio admin will review and approve your account.', 'unsupervised-schedular'); ?></p>
<?php elseif ($confirmResult === '1') : ?>
<p class="us-success"><?php esc_html_e('Thanks — your email is confirmed. Your account is now awaiting studio approval; we will email you when it is ready.', 'unsupervised-schedular'); ?></p>
<p><a href="<?php echo esc_url($loginUrl); ?>"><?php esc_html_e('Sign in to your account', 'unsupervised-schedular'); ?></a></p>
<?php else : ?>
<?php if ($confirmResult === 'expired') : ?>
<p class="us-error" role="alert"><?php esc_html_e('That confirmation link is invalid or has expired. Please contact the studio.', 'unsupervised-schedular'); ?></p>
<?php endif; ?>
<?php if (! $canRegister) : ?>
<p><?php esc_html_e('Registration is by invitation only. Please use the link from your invitation email, or contact the studio.', 'unsupervised-schedular'); ?></p>
<?php else : ?>
<?php if ($error !== '') : ?>
<p class="us-error" role="alert"><?php echo esc_html($error); ?></p>
<?php endif; ?>
<form method="post" action="">
<?php wp_nonce_field('us_student_register'); ?>
<input type="hidden" name="us_invite" value="<?php echo esc_attr($token); ?>">
<p>
<label for="us-reg-email"><?php esc_html_e('Email', 'unsupervised-schedular'); ?></label>
<?php if ($inviteValid && $invite !== null) : ?>
<input type="email" id="us-reg-email" value="<?php echo esc_attr($invite->email); ?>" readonly>
<?php else : ?>
<input type="email" name="email" id="us-reg-email" autocomplete="email" required>
<?php endif; ?>
</p>
<p>
<label for="us-reg-name"><?php esc_html_e('Your name', 'unsupervised-schedular'); ?></label>
<input type="text" name="display_name" id="us-reg-name" autocomplete="name" required>
</p>
<p>
<label for="us-reg-pass"><?php esc_html_e('Password', 'unsupervised-schedular'); ?></label>
<input type="password" name="password" id="us-reg-pass" autocomplete="new-password" minlength="8" required>
</p>
<?php if (! empty($policyForms)) : ?>
<fieldset class="us-policies">
<legend><?php esc_html_e('Policies', 'unsupervised-schedular'); ?></legend>
<?php foreach ($policyForms as $form) : ?>
<div class="us-policy">
<h4><?php echo esc_html($form['policy']->title); ?></h4>
<div class="us-policy-body"><?php echo wp_kses_post((string) $form['version']->body); ?></div>
<label>
<input type="checkbox" name="accept[]" value="<?php echo esc_attr((string) $form['version']->id); ?>" required>
<?php
/* translators: %s: policy title */
echo esc_html(sprintf(__('I have read and agree to the %s.', 'unsupervised-schedular'), $form['policy']->title));
?>
</label>
</div>
<?php endforeach; ?>
</fieldset>
<?php endif; ?>
<p>
<input type="submit" name="us_register" value="<?php esc_attr_e('Create Account', 'unsupervised-schedular'); ?>">
</p>
</form>
<?php endif; ?>
<?php endif; ?>
</div>