Create user programatically after e-mail verification

Question

I am programatically creating user with this code:

    $new_user = array(
        'name' => $state['unique_name'],
        'mail' => $state['values']['email'],
        'pass' => $state['values']['password'],
        'status' => 1,
        'init' => $state['values']['email'],
        'roles' => array($role->rid => $role->name),
    );

    $account = user_save(NULL, $new_user);
    _user_mail_notify('register_pending_approval', $account);

This code is creating user and should send verification email, after which user should be able to log in. Problem is that users are able to log in immediately.

Please note that I work on localhost and cannot send email from localhost. I will have very little time to test site on real server, so I would like to know the solution in advance.

The solution could be this approach:

The only way I was able to accomplish this was by setting the users' status to 0, then sending a custom email with a link to a custom verification page. The link contains the ID of the user and a hash of a private key concatenated with the user's email. On the verification page, I pull the user's email from the database based on the ID in the URL, concatenate the private key to the email and hash it, if the hash matches the hash in the URL, I set the user's status to 1, enabling the user to login.

But the next question is how to generate that "private key" from user database datas and from email link. I can't see any private key of user in drupal database.

Answer 1

you don't get private keys from the database because Drupal doesn't store them.

try looking up in settings.php for the $drupal_hash_salt variable. that's the one used to encode/decode strings.

hope this helps.

cheers

Answer 2

I found out by exploring user.module that this "private key" can be generated by user_pass_rehash function.

Answer 3

I suggest you use SMTP module to allow your site to send email using your GMAIL account.

Secondly you encrypt the user id(uid) using any symmetric key algo (here) and send the link to confirm. During confirmation just decrypt the uid and enable it. So simple!

Answer 4

I may be obvious, but the problem is that you are sending the wrong email to the user. You should use

_user_mail_notify('register_no_approval_required', $account);

You are currently sending an email to the user that is pending administrative approval. Also for user_save(), pass an empty string for the account instead of NULL user_save('',$new_user). It should not have an effect, but most of the user save code uses empty().