Changeset 3625941

Timestamp:

07/28/2026 01:15:20 PM (3 months ago)

Author:

i4awordpress

Message:

Fix contact-to-user lookup in Authenticate: honor custom DB table prefix and
match the full contact ID.

The lookup in Authenticate::getWordpressUserData() had two defects, both of
which the equivalent lookup in AutoLogin has always handled correctly:

1. It queried the table name "wp_usermeta" literally instead of using $wpdb->usermeta. On any site with a custom database table prefix the query returned nothing. Where a leftover wp_usermeta table exists it does not even error - it just silently finds no match, so the plugin creates a duplicate WordPress account for the member rather than updating the existing one. Confirmed against a live site using a custom prefix.

2. The LIKE pattern had no terminating semicolon, so the contact ID was matched as a prefix - a lookup for contact 12 would also match 1234 and could return the wrong WordPress user. This affects all sites, including those on the default prefix.

The query is now identical to the one in AutoLogin.php, which has been running
this form in production without issue.

Risk: on default-prefix sites $wpdb->usermeta resolves to "wp_usermeta", so
the generated SQL for defect 1 is unchanged. Defect 2 is a behavior change,
but it replaces a match that could return the wrong account.

Files changed:
trunk/src/i4aAuth/Authenticate.php
trunk/i4a-single-sign-on.php (version 3.0 -> 3.0.1)
trunk/readme.txt (Tested up to 7.0, added Changelog)

Location:

internet4associations-single-sign-on/trunk

Files:

• i4a-single-sign-on.php (modified) (1 diff)
• readme.txt (modified) (2 diffs)
• src/i4aAuth/Authenticate.php (modified) (1 diff)

internet4associations-single-sign-on/trunk/i4a-single-sign-on.php

@@ -4 +4 @@
  * Plugin URI: https://www.i4a.com/ams-integrations/wordpress-association-integration/
  * Description: Authenticate users to sign in using i4a credentials.
- * Version: 3.0
+ * Version: 3.0.1
  * Author: Internet4Associations
  * Author URI: http://www.i4a.com/

internet4associations-single-sign-on/trunk/readme.txt

@@ -2 +2 @@
 Tags: sso, single sign-on, membership, AMS, association management, membership management
 Requires at least: 3.0.1
-Tested up to: 6.9 
+Tested up to: 7.0
 Stable tag: 2.0
 License: GPLv2 or later
@@ -90 +90 @@
 
 1. Plugin Settings. Enter your i4a API credentials here (received from i4a) and configure your plugin options.
+
+== Changelog ==
+
+= 3.0.1 =
+* Fixed: the lookup that matches an i4a contact to an existing WordPress user assumed the default "wp_" database table prefix. On sites using a custom table prefix the lookup silently returned no results, which could cause a duplicate WordPress account to be created for a member instead of updating their existing one.
+* Fixed: the same lookup matched the i4a contact ID as a partial value, so a contact ID could match a longer ID that began with the same digits (for example 12 matching 1234) and return the wrong WordPress user.

internet4associations-single-sign-on/trunk/src/i4aAuth/Authenticate.php

@@ -196 +196 @@
                         return false; 
                 } 
-                $lookupQuery = "select * from wp_usermeta where meta_value like '%\"cst_id\";i:" . (int) esc_sql($i4aWPUsername) . "%'";
+                $lookupQuery = sprintf('select * from %s where meta_value like "%s" limit 1', $wpdb->usermeta, '%\\"cst_id\\";i:' . (int) esc_sql($i4aWPUsername) . ';%');
                 $i4aWpUserObj = $wpdb->get_row($lookupQuery);
                 if (!is_object($i4aWpUserObj)) {