"validated" metadata is deleted when user changes email making it more difficult to search

[stanbray]

When a user changes his email address, the account becomes unvalidated and the "validated" and "validated_method" metadata is deleted in set_user_validation_status() in engine/lib/users.php. This makes it so that you cannot use elgg_get_entities_from_metadata() to get a list of unvalidated users using the "validated" metadata as is done in the siteaccess 2.6 plugin. I propose to set the "validated" metadata to false and optionally clear the "validated_method" metadata. To implement this I propose the following change in users.php:

In set_user_validation_status(), change:

(delete_metadata($validated->id)) &&
(delete_metadata($validated_method->id))

to:

(create_metadata ($user_guid, 'validated', false, , 0, ACCESS_PUBLIC)) &&
(create_metadata ($user_guid, 'validated_method', $method, , 0, ACCESS_PUBLIC))

[brettp]

The validation was changed from what you describe to deleting the metadata in [svn:3184] to address #896. I'm not comfortable making a change like this to user registration so late in 1.7's release cycle. Ticket #1418 addresses the email validation overloading problem and was fixed for 1.8.

If searching is the only concern, there's a function in 1.8's email validation plugin that does it fairly easily. Look at the ​Admin Interface View for how the function is used with elgg_get_entities()s to list unvalidated users.

[stanbray]

Brett,

Thanks for the history info, although I have not run into the #896 problem. In order to use the email validation plugin, I will also have to pull in the 1.8 lib/functions.php.

[brettp]

(In [svn:7022]) Refs #2518: Backported the Unvalidated Users admin section to 1.7.

[brettp]

@stanbray - You shouldn't run into #896 because it was fixed, but the fix you proposed would cause a regression and reintroduce it. I've just backported the relevant parts of 1.8's validation plugin to the 1.7 branch. If you still need to list unvalidated users, look at the function included in this version of user validation by email--It doesn't require anything from 1.8.

[stanbray]

@brettp - I probably did not run into #896 because siteaccess 2.6 requires you to disable uservalidationbyemail (it provides its own email validation). Which also means I will need to add the uservalidationbyemail_get_unvalidated_users_sql_where() function to the start.php for siteaccess. I need to view the unvalidated users in siteaccess because in addition to email validation, users are activated manually by an admin. Without listing all the inactivated users, I would have to manually look at each user's profile to see that they required re-activation. Even though I cannot use your backports to uservalidationbyemail, I can still use it as a guide for updates to siteaccess. Thanks.