WordPress.org

Make WordPress Core

Opened 5 years ago

Last modified 12 months ago

#32994 new defect (bug)

invite email from secondary blog does not use network site URL for wp-activate link

Reported by: leedo Owned by:
Milestone: Priority: normal
Severity: normal Version: 4.2.2
Component: Networks and Sites Keywords: reporter-feedback
Focuses: multisite Cc:

Description

When inviting a user as an admin from a secondary site, the message uses site_url('wp-activate.php?key=$key') to generate the invite link. This is a problem because wp-activate.php returns a 404 when accessed outside the network site domain. Instead it should use network_site_url('wp-activate.php?key=$key'), as is done elsewhere.

Here is the line in question: https://core.trac.wordpress.org/browser/trunk/src/wp-includes/ms-functions.php#L953

Change History (4)

#1 @leedo
5 years ago

A little more info:

Elsewhere, the functionwpmu_signup_blog_notification is used to send the invite email. And it uses network_site_url to generate the link.
https://core.trac.wordpress.org/browser/trunk/src/wp-includes/ms-functions.php#L832

user-new.php has it's own email template instead, and uses wpmu_signup_user_notification to generate the link. This function uses site_url instead.
https://core.trac.wordpress.org/browser/trunk/src/wp-admin/user-new.php#L25

I don't see any reason they should generate different links. Perhaps the wp-activate.php link on secondary blogs is meant to redirect to the primary site, but it does not for me.

#2 @RMarks
4 years ago

  • Keywords reporter-feedback added

Hi @leedo, I setup a network and created a user as admin from a secondary site. For reference, here's how I did this. Logged into the Network as its admin user. Browsed to My Sites > Network Admin > Sites. Under the secondary site, I cliked that site's Dashabord link. In that site's menu, I browsed to Users > Add User (/wp-admin/user-new.php).

The email that was generated took me to site_url('wp-activate.php?key=$key'), although that page did not show a 404. Can you please explain what you mean by this?

wp-activate.php returns a 404 when accessed outside the network site domain.

#3 @cornelisonc
4 years ago

I have also had this same issue -- the url generated in the link was "www.main.com/blog-name/wp-activate.php?key=activation_key", which resulted in a 404 error on that page inside the blog-name site. However, if the url generated in the user's activation email is changed to remove the blog-name like so: "www.main.com/wp-activate.php?key=activation_key", the account is successfully activated.

This ticket was mentioned in Slack in #core-multisite by jeremyfelt. View the logs.


3 years ago

Note: See TracTickets for help on using tickets.