Skip to content

Fix WP Approve User integration for v12+ three-state meta - #48

Open
obenland wants to merge 1 commit into
stellarwp:masterfrom
obenland:fix/wp-approve-user-three-state-meta
Open

Fix WP Approve User integration for v12+ three-state meta#48
obenland wants to merge 1 commit into
stellarwp:masterfrom
obenland:fix/wp-approve-user-three-state-meta

Conversation

@obenland

@obenland obenland commented May 29, 2026

Copy link
Copy Markdown

Summary

WP Approve User v12 switched the wp-approve-user user meta from a boolean to a three-state string: 'approved', 'pending', or 'unapproved'. The integration's is_pending() check at core/includes/integrations/class-rcp-wp-approve-user.php:63 still treats the meta as a boolean:

return (bool) is_user_logged_in()
    && ! get_user_meta( $user_id, 'wp-approve-user', true )
    && ! user_can( $user_id, 'edit_pages' );

Every v12+ string is truthy, so ! $meta is always false. Pending and unapproved users surface as approved and gain access to content that should be restricted.

Fix

Compare the stored value against the canonical v12+ string ('approved') and the legacy '1' boolean still present on pre-v12 installs. Anything else is treated as pending. This is forward- and backward-compatible across WP Approve User versions.

return 'approved' !== $status && true !== $status && '1' !== $status;

Test plan

  • Activate WP Approve User v12+, register a user (status 'pending'), log in as that user, and confirm they cannot view content gated by [restrict] or post-level RCP restrictions.
  • Unapprove an approved user (status 'unapproved') and confirm they are blocked from restricted content on next page load.
  • Approve a pending user via the RCP member-row "Approve" action and confirm they regain access.
  • On a site running WP Approve User v11 or earlier (legacy boolean storage), confirm approve/unapprove still work — the '1' and empty-string code paths must keep functioning.

WP Approve User v12 switched the `wp-approve-user` user meta from a
boolean to a three-state string: 'approved', 'pending', or
'unapproved'. The existing `is_pending()` check tests the meta with
`! get_user_meta(...)`, which only worked when the stored value was
the legacy boolean. Every v12+ string is truthy, so pending and
unapproved users now appear approved and gain access to restricted
content.

Compare the stored value against both the canonical v12+ strings and
the legacy `'1'` representation pre-v12 installs still hold, so the
check works on every WP Approve User version.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant