Allow admins to add new users to network & site w/o confirmation email

  • Resolved Scott Fennell

    (@scofennellgmailcom)


    12 years, 6 months ago

    Hi,

    We have a network with about 300 blogs on wpmu, and about 3000 user accounts.

    Our customer support department is under duress because clients find it difficult to add their colleagues to the blog.

    This is what I need to set up, and I am totally prepared to write every line of the code myself–just don’t want to re-invent the wheel. Maybe I’m missing something obvious or maybe there is a plugin for it.

    1. Admin level users can add brand new users to the network.

    2. Preferably, in doing so, that new user is added to a specified blog in the network and, at least for now, ONLY that blog.

    3. When adding that user, the admin can immediately access and edit that users biographical info.

    4. This means that a confirmation email sent to the new user is out of the question. The admin user should not have to log in to his colleagues email account in order to activate the account.

    5. There is the option of setting up a dummy email account, like accounts@company-name-here.com. In theory, the admin user could use this dummy account to kick start new users. But sometimes the admin is adding 100+ users. We can’t have this extra step.

    I was looking at users.php in the wp-admin folder and I see that the “skip confirmation email” mode is littered with checks for if(is_super_admin). So this is going to be a solution that ties in with the existing registration API, as far as I can tell.

    My idea:

    1. Use the remove_menu_page to get rid of the currently useless (for this discussion) Add User page

    2. Use add_menu_page to add a new and useful Super Add User page.

    3. Just make a custom form with prompts for username, email, and password. Handle the form using add_user and add_user_to_blog. I’ll have to encrypt the password on my own before writing it to the DB.

    4. That … should … work. Right?

    Thanks for your thoughts on this. Again, not looking to burden anyone with demands for code snippets, just looking for big-picture objections / support.

Viewing 3 replies - 1 through 3 (of 3 total)
  • Moderator bcworkz

    (@bcworkz)

    I’d say you have a good handle on what needs to happen. I’m not too knowledgeable about wpmu, so I may be missing something related.

    A minor point, is add_user a function? I think you may be able to just use wp_create_user(). It takes a plaintext password argument and hashes it for you.

    Just to be sure we’re not missing something, do a quick and dirty test version as a proof of concept before investing any significant development time. (I’m sure you would do this anyway, I only mention it as a general point for anyone else following along.)

    Thread Starter Scott Fennell

    (@scofennellgmailcom)

    bcworkz: Yes, I meant to say wp_create_user() but was using my other hand to eat breakfast at the time and didn’t want to stop and search the codex. I did NOT realize that it hashed the password for you. Very good. Thanks for the vote of confidence!

    Should have a snippet later this week, or may just pluginify it if it’s not buggy at all.

    Thread Starter Scott Fennell

    (@scofennellgmailcom)

    Alright,

    Got this working. Unfortunately, and something I did not consider when I started this thread, is that I’m not going paste in code that I wrote for my employer.

    I feel fine about fleshing out the considerations though and pointing to some resources:

    1. I was focusing on the need to create users, and lost site of the need to edit users. This was a roadblock, resolved by the thread here:

    https://thereforei.am/2011/03/15/how-to-allow-administrators-to-edit-users-in-a-wordpress-network/

    2. There is a security concern associated with this issue: You may not want to allow a user to add an existing network user to his blog, and then alter that users profile information. The solution I came up with was to filter users by email domain. If a user is from your email domain, then you can add him to your blog and edit his profile. We also established a blacklist of common free email services, so that, for example, gmail users are not melee-ing each other.

    3. It was helpful to read all users into a jQueryUI autosuggest, to help with adding existing users.

    4. Don’t forget to use Nonces any and every time you have a form in WP!

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Allow admins to add new users to network & site w/o confirmation email’ is closed to new replies.