Changeset 10928

Timestamp:

04/27/2021 04:24:21 AM (3 years ago)

Author:

dd32

Message:

Login: Allow registrations with "low reCaptcha scores" to register, but go into a pending-moderation state.

This will allow legitimate users who receive a "Please try again" error to be manually approved.

This will also allow us to experiment with more aggressive anti-spam measures, as the majority of current spam registrations are human generated.

Location:

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login

Files:

• admin/class-user-registrations-list-table.php (modified) (9 diffs)
• admin/ui.php (modified) (5 diffs)
• functions-registration.php (modified) (5 diffs)
• functions-restapi.php (modified) (1 diff)
• pending-create.php (modified) (6 diffs)
• pending-profile.php (modified) (4 diffs)
• register.php (modified) (3 diffs)

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/admin/class-user-registrations-list-table.php

@@ -2 +2 @@
 
 class User_Registrations_List_Table extends WP_List_Table {
+
+    function get_views() {
+        global $wpdb;
+
+        $views = [
+            [
+                'all',
+                'All',
+            ],
+            [
+                'pending',
+                'Pending Email Confirmation',
+            ],
+            [
+                'registered',
+                'Completed registration',
+            ],
+            [
+                'spam',
+                'Caught in spam',
+            ],
+            [
+                'akismet',
+                'Akismet said no',
+            ]
+        ];
+
+        $default      = 'all';
+        $current_view = $_REQUEST['view'] ?? $default;
+
+        if ( isset( $_GET['s'] ) ) {
+            $default = 'search';
+            $views[0] = [
+                'search', 'All search results'
+            ];
+
+            array_unshift( $views, [ 'all', 'All' ] );
+
+            if ( 'all' === $current_view ) {
+                $current_view = 'search';
+            }
+        }
+
+        return array_map(
+            function( $item ) use ( $current_view ) {
+                global $wpdb;
+
+                $count = $wpdb->get_var(
+                    "SELECT count(*) FROM {$wpdb->base_prefix}user_pending_registrations WHERE " .
+                    $this->get_where_sql( $item[0] )
+                );
+
+                $url = admin_url( 'index.php?page=user-registrations' );
+                if ( !empty( $_GET['s'] ) && 'all' != $item[0] ) {
+                    $url = add_query_arg( 's', urlencode( $_GET['s'] ), $url );
+                }
+
+                $url = add_query_arg( 'view', $item[0], $url );
+
+                return sprintf(
+                    '<a href="%s" class="%s">%s <span class="count">(%s)</span></a>',
+                    $url,
+                    $current_view === $item[0] ? 'current' : '',
+                    $item[1],
+                    number_format_i18n( $count ),
+                );
+            }, $views
+        );
+    }
+
+    protected function get_view_sql_where( $view ) {
+        switch ( $view ) {
+            case 'pending':
+                return 'created = 0 AND cleared = 1';
+            case 'spam':
+                return 'cleared = 0';
+            case 'akismet':
+                return "meta LIKE '%akismet_result\":\"spam%'";
+            case 'registered':
+                return 'created = 1';
+            default:
+            case 'all':
+                return '1=1';
+        }
+    }
+
+    protected function get_where_sql( $view = null ) {
+        global $wpdb;
+
+        $where = $this->get_view_sql_where( $view ?: ( $_REQUEST['view'] ?? 'all' ) );
+
+        if ( isset( $_GET['s'] ) && 'all' != $view ) {
+             $search_like = '%' . $wpdb->esc_like( wp_unslash( $_GET['s'] ) ) . '%';
+             $where .= $wpdb->prepare(
+                 " AND ( user_login LIKE %s OR user_email LIKE %s OR meta LIKE %s )",
+                 $search_like, $search_like, $search_like
+            );
+        }
+
+        return $where;
+    }
 
     function get_columns() {
         return [
-            'pending_id'      => 'ID',
-            'created'         => 'Created',
             'user_login'      => 'User Login',
-            'user_email'      => 'User Email',
-            'user_ip'         => 'IP',
-            'scores'          => 'reCaptcha',
-            'akismet'         => 'Akismet',
-            'user_registered' => 'Registered Date',
-            'created_date'    => 'Created Date',
+            'meta'            => 'Meta',
+            'scores'          => 'Anti-spam<br>reCaptcha Akismet',
+            'user_registered' => 'Registered',
         ];
      }
@@ -19 +115 @@
      public function get_sortable_columns() {
         return [
-            'pending_id'      => array( 'pending_id', false ),
-            'created'         => array( 'created', true ),
             'user_login'      => array( 'user_login', true ),
-            'user_email'      => array( 'user_email', true ),
             'scores'          => array( 'scores', true ),
-            'akismet'         => array( 'akismet', true ),
             'user_registered' => array( 'user_registered', true ),
-            'created_date'    => array( 'created_date', true ),
         ];
      }
@@ -52 +143 @@
        $current_page = $this->get_pagenum();
 
-       $where = '1 = 1 ';
-       if ( isset( $_GET['s'] ) ) {
-            $search_like = '%' . $wpdb->esc_like( $_GET['s'] ) . '%';
-            $where .= $wpdb->prepare(
-                "AND ( user_login LIKE %s OR user_email LIKE %s OR meta LIKE %s )",
-                $search_like, $search_like, $search_like
-           );
-       }
+       $where = $this->get_where_sql();
 
        $per_page_offset = ($current_page-1) * $per_page;
@@ -82 +166 @@
     }
 
-    function column_created( $item ) {
-        echo ( $item->created ? 'Yes' : 'No' );
-
-        if ( ! $item->created ) {
-            $url = add_query_arg(
-                'email',
-                urlencode( $item->user_email ),
-                admin_url( 'admin-post.php?action=login_resend_email' )
-            );
-            $url = wp_nonce_url( $url, 'resend_' . $item->user_email );
-            echo $this->row_actions( [
-                'resend' => '<a href="' . esc_url( $url ) . '">Resend Email</a>',
-            ] );
-        }
-    }
-
     function column_user_registered( $item ) {
         printf(
@@ -104 +172 @@
             human_time_diff( strtotime( $item->user_registered ) )
         );
-    }
-
-    function column_created_date( $item ) {
+
         if ( $item->created_date && '0000-00-00 00:00:00' !== $item->created_date ) {
             printf(
-                '<abbr title="%s">%s ago</abbr>',
+                '<br>Created: <abbr title="%s">%s ago</abbr>',
                 esc_attr( $item->created_date ),
                 human_time_diff( strtotime( $item->created_date ) )
             );
-        } else {
-            echo '&nbsp;';
         }
     }
@@ -122 +186 @@
             $url = esc_url( 'https://profiles.wordpress.org/' . $item->user_login . '/' );
             echo "<a href='$url'>" . esc_html( $item->user_login ) . '</a>';
+
+            if (
+                ( $user = get_user_by( 'login', $item->user_login ) ) &&
+                'BLOCKED' === substr( $user->user_pass, 0, 7 )
+            ) {
+                echo ' <span class="delete-red">(blocked)</span>';
+            }
+
         } else {
             echo esc_html( $item->user_login );
         }
-    }
-
-    function column_user_email( $item ) {
+
+        echo '<hr>';
+
         list( $email_user, $domain ) = explode( '@', $item->user_email, 2 );
 
@@ -136 +208 @@
             esc_html( $domain )
         );
-    }
-
-
-    function column_user_ip( $item ) {
+
+        $row_actions = [];
+
+        if ( ! $item->created && $item->cleared ) {
+            $url = add_query_arg(
+                'email',
+                urlencode( $item->user_email ),
+                admin_url( 'admin-post.php?action=login_resend_email' )
+            );
+            $url = wp_nonce_url( $url, 'resend_' . $item->user_email );
+
+            $row_actions['resend'] = '<a href="' . esc_url( $url ) . '">Resend Email</a>';
+        }
+
+        if ( ! $item->created ) {
+            if ( $item->user_activation_key ) {
+                $url = add_query_arg(
+                    'email',
+                    urlencode( $item->user_email ),
+                    admin_url( 'admin-post.php?action=login_block' )
+                );
+                $url = wp_nonce_url( $url, 'block_' . $item->user_email );
+    
+                $row_actions['block'] = '<a href="' . esc_url( $url ) . '">Block Registration</a>';
+            }
+
+            $url = add_query_arg(
+                'email',
+                urlencode( $item->user_email ),
+                admin_url( 'admin-post.php?action=login_delete' )
+            );
+            $url = wp_nonce_url( $url, 'delete_' . $item->user_email );
+
+            $row_actions['delete'] = '<a href="' . esc_url( $url ) . '">Delete</a>';
+
+        } else {
+            $url = add_query_arg(
+                'email',
+                urlencode( $item->user_email ),
+                admin_url( 'admin-post.php?action=login_block_account' )
+            );
+            $url = wp_nonce_url( $url, 'block_account_' . $item->user_email );
+
+            if (
+                ! ( $user = get_user_by( 'login', $item->user_login ) ) ||
+                'BLOCKED' !== substr( $user->user_pass, 0, 7 )
+            ) {
+                $row_actions['block-account'] = '<a href="' . esc_url( $url ) . '">Block Account</a>';
+            }
+
+        }
+
+        if ( $row_actions ) {
+            echo $this->row_actions( $row_actions );
+        }
+
+    }
+
+
+    function column_meta( $item ) {
         $meta = json_decode( $item->meta );
 
@@ -158 +286 @@
             )
         );
+        echo '<hr>';
+
+        foreach ( [ 'url', 'from', 'occ', 'interests' ] as $field ) {
+            if ( !empty( $meta->$field ) ) {
+                printf( "%s: %s<br>", esc_html( $field ), esc_html( $meta->$field ) );
+            }
+        }
     }
 
     function column_scores( $item ) {
+
+        echo ( $item->cleared ? 'Passed' : 'Failed' ) . '<br>';
+
         foreach ( json_decode( $item->scores ) as $type => $val ) {
             printf(
@@ -168 +306 @@
             );
         }
-    }
-
-    function column_akismet( $item ) {
-        $meta = json_decode( $item->meta, true );
-
-        echo $meta['akismet_result'] ?? '';
+
+        $meta    = json_decode( $item->meta );
+        $akismet = $meta->akismet_result ?? '';
+        if ( $akismet ) {
+            printf(
+                '<abbr title="%s">%s</abbr> ',
+                esc_attr( 'Akismet' ),
+                esc_html( strtolower( $akismet ) )
+            );
+        }
+
+        $row_actions = [];
+
+        if ( ! $item->created && $item->user_activation_key ) {
+            $url = add_query_arg(
+                'email',
+                urlencode( $item->user_email ),
+                admin_url( 'admin-post.php?action=login_block' )
+            );
+            $url = wp_nonce_url( $url, 'block_' . $item->user_email );
+
+            $row_actions['block'] = '<a href="' . esc_url( $url ) . '">Block Registration</a>';
+        }
+
+        if ( ! $item->cleared ) {
+            $url = add_query_arg(
+                'email',
+                urlencode( $item->user_email ),
+                admin_url( 'admin-post.php?action=login_mark_as_cleared' )
+            );
+            $url = wp_nonce_url( $url, 'clear_' . $item->user_email );
+            $row_actions['approve-reg'] = '<a href="' . esc_url( $url ) . '">Approve</a>';
+        }
+
+        if ( $row_actions ) {
+            echo $this->row_actions( $row_actions );
+        }
     }
 

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/admin/ui.php

@@ -13 +13 @@
 });
 
+function wporg_login_admin_action_text( $action ) {
+    switch ( $action ) {
+        case 'resent-email':
+            return 'The registration email has been resent.';
+        case 'approved':
+            return 'The registration has been approved, and a confirmation email has been sent.';
+        case 'deleted':
+            return 'The registration record has been removed.';
+        case 'blocked':
+            return 'The registration has been blocked.';
+        case 'blocked_account':
+            return 'Account blocked.';
+        default:
+            return 'Action performed.';
+    }
+}
+
 function wporg_login_admin_page() {
     $wp_list_table = new User_Registrations_List_Table();
     $wp_list_table->prepare_items();
 
-    echo '<style>
+    ?><script>
+    jQuery( document ).ready( function($) {
+        $( 'table .row-actions a' ).click( function( e ) {
+            e.preventDefault();
+
+            var $this = $(this),
+                $tr   = $this.parents('tr'),
+                $tds  = $tr.find( 'td:not(:first)' );
+
+            $tds.remove();
+            $tr.find( '.row-actions' ).remove();
+            $tr.append( "<td colspan=" + $tds.length + ">...</td>" );
+
+            var url = $this.prop('href') + '&ajax=1';
+
+            $.get( url, function( data ) {
+                $tr.find('td:last').text( data );
+            } );
+        });
+    } );
+    </script>
+    <style>
         table.dashboard_page_user-registrations td > a {
             color: inherit;
@@ -24 +62 @@
             text-decoration: underline;
         }
-    </style>';
+        table.dashboard_page_user-registrations .delete-red {
+            color: #b32d2e;
+        }
+    </style>
+    <?php
 
     echo '<div class="wrap">';
@@ -30 +72 @@
     echo '<hr class="wp-header-end">';
 
-    if ( isset( $_REQUEST['resent-email'] ) ) {
-        echo '<div class="updated notice"><p>The registration email has been resent.</p></div>';
+    if ( isset( $_GET['action'] ) ) {
+        echo '<div class="updated notice"><p>';
+        echo wporg_login_admin_action_text( $_GET['action'] );
+        echo '</p></div>';
     }
 
@@ -37 +81 @@
     printf( '<input type="hidden" name="page" value="%s">', esc_attr( $_GET['page'] ) );
 
-    //$wp_list_table->views();
+    $wp_list_table->views();
     $wp_list_table->search_box( 'Search', 's' );
     $wp_list_table->display();
@@ -58 +102 @@
     }
 
-    wp_safe_redirect( add_query_arg(
-        's',
-        urlencode( $email ),
-        'https://login.wordpress.org/wp-admin/index.php?page=user-registrations&resent-email=true'
-    ) );
-    exit;
-});
+    if ( isset( $_GET['ajax'] ) ) {
+        die( wporg_login_admin_action_text( 'resent-email' ) );
+    }
+
+    wp_safe_redirect( add_query_arg(
+        's',
+        urlencode( $email ),
+        'https://login.wordpress.org/wp-admin/index.php?page=user-registrations&action=resent-email'
+    ) );
+    exit;
+} );
+
+add_action( 'admin_post_login_mark_as_cleared', function() { 
+    if ( ! current_user_can( 'manage_users' ) ) {
+        wp_die();
+    }
+
+    $email = $_REQUEST['email'] ?? '';
+
+    check_admin_referer( 'clear_' . $email );
+
+    $user = wporg_get_pending_user( $email );
+    if ( $user ) {
+        $user['cleared'] = 2;
+        wporg_update_pending_user( $user );
+
+        wporg_login_send_confirmation_email( $user['user_email'] );
+    }
+
+    if ( isset( $_GET['ajax'] ) ) {
+        die( wporg_login_admin_action_text( 'approved' ) );
+    }
+
+    wp_safe_redirect( add_query_arg(
+        's',
+        urlencode( $email ),
+        'https://login.wordpress.org/wp-admin/index.php?page=user-registrations&action=approved'
+    ) );
+    exit;
+} );
+
+add_action( 'admin_post_login_block', function() { 
+    if ( ! current_user_can( 'manage_users' ) ) {
+        wp_die();
+    }
+
+    $email = $_REQUEST['email'] ?? '';
+
+    check_admin_referer( 'block_' . $email );
+
+    $user = wporg_get_pending_user( $email );
+    if ( $user ) {
+        $user['cleared']             = 0;
+        $user['user_activation_key'] = '';
+        $user['user_profile_key']    = '';
+
+        wporg_update_pending_user( $user );
+    }
+
+    if ( isset( $_GET['ajax'] ) ) {
+        die( wporg_login_admin_action_text( 'blocked' ) );
+    }
+
+    wp_safe_redirect( add_query_arg(
+        's',
+        urlencode( $email ),
+        'https://login.wordpress.org/wp-admin/index.php?page=user-registrations&action=blocked'
+    ) );
+    exit;
+} );
+
+add_action( 'admin_post_login_delete', function() { 
+    if ( ! current_user_can( 'manage_users' ) ) {
+        wp_die();
+    }
+
+    $email = $_REQUEST['email'] ?? '';
+
+    check_admin_referer( 'delete_' . $email );
+
+    $user = wporg_get_pending_user( $email );
+    if ( $user ) {
+        wporg_delete_pending_user( $user );
+    }
+
+    if ( isset( $_GET['ajax'] ) ) {
+        die( wporg_login_admin_action_text( 'deleted' ) );
+    }
+
+    wp_safe_redirect( add_query_arg(
+        's',
+        urlencode( $email ),
+        'https://login.wordpress.org/wp-admin/index.php?page=user-registrations&action=deleted'
+    ) );
+    exit;
+} );
+
+add_action( 'admin_post_login_block_account', function() { 
+    if ( ! current_user_can( 'manage_users' ) ) {
+        wp_die();
+    }
+
+    $email = $_REQUEST['email'] ?? '';
+
+    check_admin_referer( 'block_account_' . $email );
+
+    $user = get_user_by( 'email', $email );
+    if ( $user && defined( 'WPORG_SUPPORT_FORUMS_BLOGID' ) ) {
+        // Load the support forums.. 
+        include_once WP_PLUGIN_DIR . '/bbpress/bbpress.php';
+        include_once WP_PLUGIN_DIR . '/support-forums/support-forums.php';
+
+        // Then switch to it (Must be done after bbPress is loaded to get roles)
+        switch_to_blog( WPORG_SUPPORT_FORUMS_BLOGID );
+
+        // Set the user to blocked. Support forum hooks will take care of the rest.
+        bbp_set_user_role( $user->ID, bbp_get_blocked_role() );
+
+        restore_current_blog();
+    }
+
+    if ( isset( $_GET['ajax'] ) ) {
+        die( wporg_login_admin_action_text( 'blocked_account' ) );
+    }
+
+    wp_safe_redirect( add_query_arg(
+        's',
+        urlencode( $email ),
+        'https://login.wordpress.org/wp-admin/index.php?page=user-registrations&action=blocked_account'
+    ) );
+    exit;
+} );
+

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/functions-registration.php

@@ -1 +1 @@
 <?php
 
-function wporg_login_check_recapcha_status( $check_v3_action = false ) {
+function wporg_login_check_recapcha_status( $check_v3_action = false, $block_low_scores = true ) {
 
     // reCaptcha V3 Checks
@@ -22 +22 @@
 
         // Block super-low scores.
-        if ( (float)$result['score'] < (float) get_option( 'recaptcha_v3_threshold', 0.2 ) ) {
+        if ( $block_low_scores && (float)$result['score'] < (float) get_option( 'recaptcha_v3_threshold', 0.2 ) ) {
             return false;
         }
@@ -122 +122 @@
     }
 
+    $pending_user['meta']['akismet_result'] = wporg_login_check_akismet( $user_login, $user_email );
+
+    $pending_user['cleared'] = (
+        'spam' !== $pending_user['meta']['akismet_result'] &&
+        (float)$pending_user['scores']['pending'] >= (float) get_option( 'recaptcha_v3_threshold', 0.2 ) 
+    );
+
     $inserted = wporg_update_pending_user( $pending_user );
     if ( ! $inserted ) {
@@ -147 +154 @@
     $user = wporg_get_pending_user( $user );
 
-    if ( ! $user || $user['created'] ) {
+    if ( ! $user || $user['created'] || ! $user['cleared'] ) {
         return false;
     }
@@ -230 +237 @@
     }
 
+}
+
+function wporg_delete_pending_user( $pending_user ) {
+    global $wpdb;
+
+    if ( empty( $pending_user['pending_id'] ) ) {
+        return false;
+    }
+
+    return $wpdb->delete(
+        "{$wpdb->base_prefix}user_pending_registrations",
+        array( 'pending_id' => $pending_user['pending_id'] )
+    );
 }
 

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/functions-restapi.php

@@ -122 +122 @@
 
     $pending_user = wporg_get_pending_user( $request['account'] );
-    if ( ! $pending_user || $pending_user['created'] ) {
+    if ( ! $pending_user || $pending_user['created'] || ! $pending_user['user_activation_key'] ) {
         return $success_message;
     }

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/pending-create.php

@@ -6 +6 @@
  */
 
-// Clear the pending cookies, they're no longer needed.
-if ( isset( $_COOKIE['wporg_profile_user'] ) ) {
-    setcookie( 'wporg_profile_user', false, time()-DAY_IN_SECONDS, '/register/', 'login.wordpress.org', true, true );
-    setcookie( 'wporg_profile_key', false,  time()-DAY_IN_SECONDS, '/register/', 'login.wordpress.org', true, true );
-}
+$sso = WPOrg_SSO::get_instance();
 
 // Migrate to cookies.
-if ( !empty( WP_WPOrg_SSO::$matched_route_params['confirm_user'] ) ) {
-    setcookie( 'wporg_confirm_user', WP_WPOrg_SSO::$matched_route_params['confirm_user'], time()+DAY_IN_SECONDS, '/register/', 'login.wordpress.org', true, true );
-    setcookie( 'wporg_confirm_key',  WP_WPOrg_SSO::$matched_route_params['confirm_key'],  time()+DAY_IN_SECONDS, '/register/', 'login.wordpress.org', true, true );
+if ( !empty( $sso::$matched_route_params['confirm_user'] ) ) {
+    setcookie( 'wporg_confirm_user', $sso::$matched_route_params['confirm_user'], time()+DAY_IN_SECONDS, '/register/', 'login.wordpress.org', true, true );
+    setcookie( 'wporg_confirm_key',  $sso::$matched_route_params['confirm_key'],  time()+DAY_IN_SECONDS, '/register/', 'login.wordpress.org', true, true );
 
     wp_safe_redirect( '/register/create' );
@@ -60 +56 @@
 }
 
-
-$error_recapcha_status = $error_akismet = false;
-if ( isset( $_POST['user_pass'] ) ) {
+$error_recapcha_status = false;
+if ( isset( $_POST['user_pass'] ) && 2 !== $pending_user['cleared'] ) {
 
     // Check reCaptcha status
-    if ( ! wporg_login_check_recapcha_status( 'pending_create' ) ) {
-        // No no. "Please try again."
+    if ( ! wporg_login_check_recapcha_status( 'pending_create', false ) ) {
+        unset( $_POST['user_pass'] );
         $error_recapcha_status = true;
-        unset( $_POST['user_pass'] );
-    }
-
-    // Check Akismet
-    $akismet = wporg_login_check_akismet(
+
+        // Allow a recaptcha fail to try again, but if they're blocked due to low score, mark them as needing approval.
+        if ( ! wporg_login_check_recapcha_status( 'pending_create', true ) ) {
+            $pending_user['cleared'] = 0;
+        }
+
+        // Store for reference.
+        if ( isset( $_POST['_reCaptcha_v3_token'] ) ) {
+            $recaptcha_api = wporg_login_recaptcha_api(
+                $_POST['_reCaptcha_v3_token'],
+                RECAPTCHA_V3_PRIVKEY
+            );
+            $pending_user['scores']['create_attempt'] = -1;
+            if ( $recaptcha_api && $recaptcha_api['success'] && 'pending_create' == $recaptcha_api['action'] ) {
+                $pending_user['scores']['create_attempt'] = $recaptcha_api['score'];
+            }
+        }
+    }
+
+    // Check Akismet with new profile information
+    $pending_user['meta']['akismet_result'] = wporg_login_check_akismet(
         $pending_user['user_login'],
         $pending_user['user_email'],
@@ -83 +94 @@
     );
 
-    // Store for reference.
-    $pending_user['meta']['akismet_result'] = $akismet;
+    if ( 'spam' === $pending_user['meta']['akismet_result'] ) {
+        $pending_user['cleared'] = 0;
+        unset( $_POST['user_pass'] );
+    }
+
     wporg_update_pending_user( $pending_user );
-
-    if ( 'spam' == $akismet ) {
-        // No no. "Please try again."
-        $error_akismet = true;
-        unset( $_POST['user_pass'] );
-    }
-
+}
+
+if ( ! $pending_user['cleared'] ) {
+    if ( ! empty( $_COOKIE['wporg_profile_user'] ) ) {
+        // Throw the user back to the pending screen after being detected as spam at this point.
+        wp_safe_redirect( '/register/create-profile/' );
+        die();
+    }
+
+    unset( $_POST['user_pass'] );
 }
 
@@ -101 +118 @@
         $user = wporg_login_create_user_from_pending( $pending_user, $user_pass );
         if ( $user ) {
+
+            // Clear the cookies, they're no longer needed.
+            setcookie( 'wporg_profile_user', false, time()-DAY_IN_SECONDS, '/register/', 'login.wordpress.org', true, true );
+            setcookie( 'wporg_profile_key',  false, time()-DAY_IN_SECONDS, '/register/', 'login.wordpress.org', true, true );
             setcookie( 'wporg_confirm_user', false, time()-DAY_IN_SECONDS, '/register/', 'login.wordpress.org', true, true );
             setcookie( 'wporg_confirm_key',  false, time()-DAY_IN_SECONDS, '/register/', 'login.wordpress.org', true, true );
@@ -121 +142 @@
 ?>
 
-<p class="intro">
-<?php _e( 'Set your password and complete your WordPress.org Profile information.', 'wporg' ); ?>
-</p>
-
 <form name="registerform" id="registerform" action="" method="post">
 
-        <p class="login-login">
-            <label for="user_login"><?php _e( 'Username', 'wporg' ); ?></label>
-            <input type="text" disabled="disabled" class=" disabled" value="<?php echo esc_attr( $activation_user ); ?>" size="20" />
-        </p>
-
-        <div class="user-pass1-wrap">
+    <?php if ( ! $pending_user['cleared'] ) { ?>
+    <div class="message info">
+        <p><?php
+            printf(
+                /* translators: %s Email address */
+                __( 'Your account is pending approval. You will receive an email at %s to set your password when approved.', 'wporg' ) . '<br>' .
+                __( 'Please contact %s for more details.', 'wporg' ),
+                '<code>' . esc_html( $pending_user['user_email'] ) . '</code>',
+                '<a href="mailto:' . $sso::SUPPORT_EMAIL . '">' . $sso::SUPPORT_EMAIL . '</a>'
+            );
+        ?></p>
+    </div>
+    <?php } ?>
+
+    <p class="intro">
+        <?php _e( 'Set your password and complete your WordPress.org Profile information.', 'wporg' ); ?>
+    </p>
+
+    <p class="login-login">
+        <label for="user_login"><?php _e( 'Username', 'wporg' ); ?></label>
+        <input type="text" disabled="disabled" class=" disabled" value="<?php echo esc_attr( $activation_user ); ?>" size="20" />
+    </p>
+
+    <div class="user-pass1-wrap">
         <p>
             <label for="pass1"><?php _e( 'Password', 'wporg' ); ?></label>
@@ -145 +180 @@
     </div>
 
-<!--    <p class="description indicator-hint"><?php _e( 'Hint: The password should be at least twelve characters long. To make it stronger, use upper and lower case letters, numbers, and symbols like ! " ? $ % ^ &amp; ).', 'wporg' ); ?></p> -->
-
     <?php
         $fields = &$pending_user['meta'];
         include __DIR__ . '/partials/register-profilefields.php';
     ?>
+
     <?php
-        if ( $error_recapcha_status || $error_akismet ) {
+        if ( $error_recapcha_status ) {
             echo '<div class="message error"><p>' . __( 'Please try again.', 'wporg' ) . '</p></div>';
         }

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/pending-profile.php

@@ -6 +6 @@
  */
 
+$sso = WPOrg_SSO::get_instance();
+
  // Migrate to cookies.
-if ( !empty( WP_WPOrg_SSO::$matched_route_params['profile_user'] ) ) {
-    setcookie( 'wporg_profile_user', WP_WPOrg_SSO::$matched_route_params['profile_user'], time()+DAY_IN_SECONDS, '/register/', 'login.wordpress.org', true, true );
-    setcookie( 'wporg_profile_key',  WP_WPOrg_SSO::$matched_route_params['profile_key'],  time()+DAY_IN_SECONDS, '/register/', 'login.wordpress.org', true, true );
+if ( !empty( $sso::$matched_route_params['profile_user'] ) ) {
+    setcookie( 'wporg_profile_user', $sso::$matched_route_params['profile_user'], time()+DAY_IN_SECONDS, '/register/', 'login.wordpress.org', true, true );
+    setcookie( 'wporg_profile_key',  $sso::$matched_route_params['profile_key'],  time()+DAY_IN_SECONDS, '/register/', 'login.wordpress.org', true, true );
 
     wp_safe_redirect( '/register/create-profile' );
@@ -54 +56 @@
     <div class="message info">
         <p><?php
+        if ( $pending_user['cleared'] ) {
             printf(
                 /* translators: %s Email address */
@@ -61 +64 @@
                 esc_attr( $pending_user['user_email'] )
             );
+        } else {
+            printf(
+                /* translators: %s Email address */
+                __( 'Your account is pending approval. You will receive an email at %s to set your password when approved.', 'wporg' ) . '<br>' .
+                __( 'Please contact %s for more details.', 'wporg' ),
+                '<code>' . esc_html( $pending_user['user_email'] ) . '</code>',
+                '<a href="mailto:' . $sso::SUPPORT_EMAIL . '">' . $sso::SUPPORT_EMAIL . '</a>'
+            );
+        }
         ?></p>
     </div>
 
     <p class="intro">
-    <?php _e( 'Complete your WordPress.org Profile information.', 'wporg' ); ?>
+        <?php _e( 'Complete your WordPress.org Profile information.', 'wporg' ); ?>
     </p>
 
@@ -72 +84 @@
         <input type="text" disabled="disabled" class=" disabled" value="<?php echo esc_attr( $profile_user ); ?>" size="20" />
     </p>
-
 
     <?php

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/register.php

@@ -15 +15 @@
 }
 
-$error_user_login = $error_user_email = $error_recapcha_status = $error_akismet = $terms_of_service_error = false;
+$error_user_login = $error_user_email = $error_recapcha_status = $terms_of_service_error = false;
 if ( $_POST ) {
 
@@ -34 +34 @@
     // handle user registrations.
     if ( ! $error_user_login && ! $error_user_email && ! $terms_of_service_error ) {
-        if ( ! wporg_login_check_recapcha_status( 'register' ) ) {
+
+        $recaptcha = wporg_login_check_recapcha_status( 'register', false /* Allow low scores to pass through */ );
+
+        if ( ! $recaptcha ) {
             $error_recapcha_status = true;
         } else {
-            $akismet = wporg_login_check_akismet( $user_login, $user_email );
-
             $tos_meta_key = WPOrg_SSO::TOS_USER_META_KEY;
             $meta = [
                 'user_mailinglist' => $user_mailinglist,
-                'akismet_result'   => $akismet,
                 $tos_meta_key      => $terms_of_service,
             ];
 
-            if ( 'spam' === $akismet ) {
-                $error_akismet = true;
-            } else {
-                wporg_login_create_pending_user( $user_login, $user_email, $meta );
-                die();
-            }
+            wporg_login_create_pending_user( $user_login, $user_email, $meta );
+            die();
         }
     }
@@ -123 +119 @@
     </p>
     <?php
-        if ( $error_recapcha_status || $error_akismet ) {
+        if ( $error_recapcha_status ) {
             echo '<div class="message error"><p>' . __( 'Please try again.', 'wporg' ) . '</p></div>';
         }