Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(my-account): add pending email change state #3763

Merged
merged 3 commits into from
Feb 20, 2025
Merged

feat(my-account): add pending email change state #3763

merged 3 commits into from
Feb 20, 2025

Conversation

chickenn00dle
Copy link
Contributor

@chickenn00dle chickenn00dle commented Feb 19, 2025 •
edited
Loading

All Submissions:

Changes proposed in this Pull Request:

Closes https://app.asana.com/0/1208993180326452/1209215513701713/f

This PR adds a pending change state to email updates in my account:

Screenshot 2025-02-19 at 14 46 11

How to test the changes in this Pull Request:

  1. Ensure the NEWSPACK_EMAIL_CHANGE_ENABLED FF is set in wp-config
  2. As a logged in reader, go to your my account dashboard
  3. Confirm the form displays your current email address
  4. Update the email address to something new and save changes
  5. Verify the page reloads, the email field now shows the new email address, is disabled, and a wc_notice appears asking you to check your new email to verify the change
  6. Confirm a basic email has been sent to the new email address (Note: we are not handling the verification link in this PR)
  7. Now remove the NEWSPACK_EMAIL_CHANGE_ENABLED FF in wp-config
  8. Go back to my account and verify the field is disabled and the old email address appears

Other information:

  • Have you added an explanation of what your changes do and why you'd like us to include them?
  • Have you written new tests for your changes, as applicable?
  • Have you successfully ran tests with your changes locally?

@chickenn00dle chickenn00dle marked this pull request as ready for review February 19, 2025 19:51
@chickenn00dle chickenn00dle requested a review from a team as a code owner February 19, 2025 19:51
@chickenn00dle chickenn00dle added the [Status] Needs Review The issue or pull request needs to be reviewed label Feb 19, 2025
dkoo
dkoo requested changes Feb 19, 2025
View reviewed changes
Copy link
Contributor

@dkoo dkoo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is working as described, but I managed to bypass the verification flow via dev tools. Details below.

includes/reader-revenue/templates/myaccount-edit-account.php
@@ -65,7 +67,8 @@ class="woocommerce-Input woocommerce-Input--text input-text"
<p class="woocommerce-form-row woocommerce-form-row--wide form-row form-row-wide mt0">
<label for="account_email_display"><?php \esc_html_e( 'Email address', 'newspack-plugin' ); ?>
<?php if ( $is_email_change_enabled ) : ?>
<input type="email" class="woocommerce-Input woocommerce-Input--email input-text" name="account_email" id="account_email" autocomplete="email" value="<?php echo \esc_attr( $user->user_email ); ?>" />
<input type="email" class="woocommerce-Input woocommerce-Input--email input-text" name="newspack_account_email" id="newspack_account_email" autocomplete="email" <?php echo \esc_attr( $is_pending_email_change ? 'disabled' : '' ); ?> value="<?php echo \esc_attr( $display_email ); ?>" />
<input type="hidden" class="woocommerce-Input woocommerce-Input--email input-text" name="account_email" id="account_email" autocomplete="email" value="<?php echo \esc_attr( $user->user_email ); ?>" />
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an edge case for sure, but if you change the value of this hidden input via dev tools, you can change the email and bypass the entire verification flow.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This may be true of trunk, too, but now's a good time to secure this better... 😅

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch @dkoo! I've addressed this in f7ea775.

This commit also handles invalid or existing emails.

@chickenn00dle chickenn00dle requested a review from dkoo February 20, 2025 15:28
dkoo
dkoo approved these changes Feb 20, 2025
View reviewed changes
Copy link
Contributor

@dkoo dkoo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the updates, @chickenn00dle! I've confirmed it's no longer possible to update the email address via the hidden field, and that invalid and preexisting email addresses are rejected.

@github-actions github-actions bot added [Status] Approved The pull request has been reviewed and is ready to merge and removed [Status] Needs Review The issue or pull request needs to be reviewed labels Feb 20, 2025
@chickenn00dle chickenn00dle merged commit c9ba046 into trunk Feb 20, 2025
9 checks passed
@chickenn00dle chickenn00dle deleted the feat/email-change-pending-state branch February 20, 2025 19:00
@github-actions GitHub Actions
Copy link

Hey @chickenn00dle, good job getting this PR merged! 🎉

Now, the needs-changelog label has been added to it.

Please check if this PR needs to be included in the "Upcoming Changes" and "Release Notes" doc. If it doesn't, simply remove the label.

If it does, please add an entry to our shared document, with screenshots and testing instructions if applicable, then remove the label.

Thank you! ❤️

matticbot pushed a commit that referenced this pull request Feb 27, 2025
@semantic-release-bot
chore(release): 6.0.0-alpha.2 [skip ci]
fec3c72 
# [6.0.0-alpha.2](v6.0.0-alpha.1...v6.0.0-alpha.2) (2025-02-27)

### Bug Fixes

* **memberships:** ensure user membership is linked to the correct subscription ([#3768](#3768)) ([a942616](a942616))
* undo forcing WC order attribution to off ([#3771](#3771)) ([c9cb52a](c9cb52a))
* **woo:** page template meta leaking to other types ([#3782](#3782)) ([325a21c](325a21c))

### Features

* add corrections customize settings ([#3751](#3751)) ([11dbc5e](11dbc5e))
* **corrections:** Unit tests for Corrections functionality ([#3776](#3776)) ([ae58933](ae58933))
* **my-account:** add change email template ([#3772](#3772)) ([32bef3c](32bef3c))
* **my-account:** add pending email change state ([#3763](#3763)) ([c9ba046](c9ba046))
* **my-account:** verify email change ([#3764](#3764)) ([b50c980](b50c980))
@matticbot
Copy link
Contributor

🎉 This PR is included in version 6.0.0-alpha.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dkoo dkoo dkoo approved these changes

Assignees
No one assigned
Labels
released on @alpha [Status] Approved The pull request has been reviewed and is ready to merge
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@chickenn00dle @matticbot @dkoo