Registering without required fields…

Hi all,

Since customising the administrators registration notification email I’ve noticed that people are able to register without entering all of the required custom fields… The form is here http://www.ispa.org.uk/members/join/

Andy idea’s how this is happening?

Cheers :)

I’m assuming your in the > General Options > Registration/Profile Fields & Options

When creating or Editing Registration/Profile Field, the 5th option down, Field Required: * is where I use this feature your speaking of.

Hope this helps.

Hi Zoe,

The form validation is handled with JavaScript, so if the validation suddenly stopped working I would look into what might be preventing the s2Member JavaScript from working/loading properly.

If you disable/undo the admin notification customization, does the validation start working again?

Hi Raam, the JS validation is working – they must be getting around it by switching off JS! Is there anyway I can add PHP validation for my custom fields without intefering with s2 updates?

They seem to be getting a handful of spam submissions a week (must be bothering to fill in the captcha though!?) and the clients going to get tired of them pretty quick!

Cheers

Thanks for the heads up on this request for support.

Everything in a Pro Form is validated extensively both client-side and server-side, except for Custom Registration/Profile Fields implemented by a site owner. These are handled via JavaScript only.

The validation of a Custom Registration/Profile Field, is based entirely on the way it’s configured by the site owner whenever they create a Custom Registration/Profile Field in the Dashboard. For example, a site owner can choose to require numerics only, or a specific number of characters, an email address, phone number, etc, etc.. Many options are available under: General Options -> Custom Registration/Profile Fields.

However, the routine within s2Member’s source code, which handles the required validation scan (i.e. based on the field’s configuration by the site owner), was written in JavaScript only, and is not yet implemented server-side. Therefore, it IS still possible for a customer to bypass certain Custom Registration/Profile Field requirements, if they bypass JavaScript. Not a common issue, but possible in cases where hackers are actually trying to bypass them, or possible on a site that’s hosting Pro Forms, which is broken in some way (e.g. JavaScript errors in other areas of the site, which might prevent s2Member Pro Forms from working as expected).

Again, not a common issue, but possible.

This will be corrected in a future release, because the validation routines are being written in PHP as well, and they’ll be integrated into the PHP form handler on the server-side too.

In the mean time, a site owner could implement their own validation routines on the server-side if they’d like.

Here’s a hack file example, for PayPal Pro Forms:
/wp-content/mu-plugins/s2-hacks.php
( these are MUST USE plugins, see: http://codex.wordpress.org/Must_Use_Plugins )

<?php
add_action("init", "my_custom_validator", 1);
function my_custom_validator()
	{
		if(!empty($_POST&#91;"s2member_pro_paypal_checkout"&#93;&#91;"nonce"&#93;))
			{
				$custom_fields = stripslashes_deep($_POST&#91;"s2member_pro_paypal_checkout"&#93;&#91;"custom_fields"&#93;);
				$response = &$GLOBALS&#91;"ws_plugin__s2member_pro_paypal_checkout_response"&#93;;
				
				if(empty($custom_fields&#91;"my_unique_field_id"&#93;)) // This custom field is missing?
					{
						// Set the error response message for s2Member to display.
						$response&#91;"error"&#93; = TRUE;
						$response&#91;"response"&#93; = "Custom Field ID `my_unique_field_id` is missing. Please try again.";
						
						// Unset this variable to prevent Pro Form processing during checkout.
						unset($_POST&#91;"s2member_pro_paypal_checkout"&#93;&#91;"nonce"&#93;);
					}
			}
	}
?>

Here’s another example for Authorize.Net Pro Forms.

<?php
add_action("init", "my_custom_validator", 1);
function my_custom_validator()
	{
		if(!empty($_POST&#91;"s2member_pro_authnet_checkout"&#93;&#91;"nonce"&#93;))
			{
				$custom_fields = stripslashes_deep($_POST&#91;"s2member_pro_authnet_checkout"&#93;&#91;"custom_fields"&#93;);
				$response = &$GLOBALS&#91;"ws_plugin__s2member_pro_authnet_checkout_response"&#93;;
				
				if(empty($custom_fields&#91;"my_unique_field_id"&#93;)) // This custom field is missing?
					{
						// Set the error response message for s2Member to display.
						$response&#91;"error"&#93; = TRUE;
						$response&#91;"response"&#93; = "Custom Field ID `my_unique_field_id` is missing. Please try again.";
						
						// Unset this variable to prevent Pro Form processing during checkout.
						unset($_POST&#91;"s2member_pro_authnet_checkout"&#93;&#91;"nonce"&#93;);
					}
			}
	}
?>

Thanks Jason :)