Event Plugin Modifications

[melindahelt]

Description

The partner is promoting a new event for May 21, and needs some edits to how the events are displayed.

Event: https://opensource.org/events/osi-maintainer-month
Where to edit event: https://opensource.org/wp-admin/post.php?post=127606&action=edit

Issue 1: Book Now Button
The booking button is empty of text, and they would like to to say "Book Now" Based on the discussion in https://wordpress.org/support/topic/change-text-of-book-now-button/ , because they are using advanced mode, I think this has to be edited within the "Single Evenet Page Format" section on https://opensource.org/wp-admin/edit.php?post_type=event&page=events-manager-options#formats+events-formats

I did try to add the text in a few places, but the CSS was way off, and I was unable to resolve that.

Issue 2: URL showing before people register
They wanted to use the Location > URL section in https://opensource.org/wp-admin/post.php?post=127606&action=edit to show a webinar URL, but when they set it up, it shows the URL for everyone. They would like this to be only shown to folks who have registered. Is it possible to use this setting, or another to force it into the email (see next issue) -- for now they have removed the URL from the event post to keep it from showing.

Calendar invite link not working in email

The link is not working in the email where it should be

Save to your calendar: Click here

I have not confirmed if it worked before they removed the URL from public view. This was previously looked at in https://wpspecialprojectsp2.wordpress.com/2023/03/29/opensource-org/#comment-37061

https://a8c.zendesk.com/agent/tickets/9755428

Steps to reproduce

No response

What you expected to happen

No response

What actually happened

No response

[nickpagz]

I was able to get this working without any code changes.

Issue 1: Book Now Button

For some reason the template was missing the button text (see the diff screen-shot). I've re-added it.
I turned on the booking option temporarily to test it. It will need to be re-enabled.

Issue 2: URL showing before people register

The plugin doesn't have a way to hide this conditionally. My suggestion is to add some css to hide the field (I've already added for just this event on production), and make sure it's added and works in the booking confirmation email.

I've changed the booking confirmation email from Where : #_EVENTLINK to Where : #_EVENTLOCATION. This was tested on staging, and the location in the event is setup like this:

Fwiw, #_EVENTLOCATION{_self} also works, and so does #_EVENTLOCATION{url}. However, the latter isn't hyperlinked text, it's just the raw location URL.

IF we want to look into displaying it on the event page only for registered users, let me know. I didn't dive into the plugin code yet to see if there's appropriate hooks or filters we can use to conditionally show the location, and I'm not sure the timeline supports the deeper dive.

Issue 3: Calendar invite link not working in email

This is working on the staging site, but it's possible the link doesn't render due to an incomplete/invalid date and time selection, AND missing location. When setting the Event Dates, I noticed the first click in the calendar is the "from" day, and the second is the "to" day. So for this event, the 21st has to be clicked two times.
I would suggest re-entering those on the production site, and adding the location, and run a test booking. Let me know if that still doesn't work on production.

Summary of next actions:

• Re-enable and configure Bookings. The button text should now display.
• Check calendar start/end dates and times, and add a location. The location should be hidden on the front-end.
• Test booking. The confirmation email should include a valid url for the location and the calendar link.
• Let me know if hiding the location using css on the front-end is an acceptable solution.

[melindahelt]

Thanks @nickpagz This all looks good, and I passed this along to partner for review.

Not sure if you saw the note that was added to this item on the dev-request, but we also wanted to take a look at:

Adding to this request, the partner mentioned they were receiving a lot of Spam submissions to this event.

The partner tried installing and using Altcha, with no change, and proceeded to disable the plugin.

[nickpagz]

I did miss that additional note, re the spam. I'll have a look and see what I can do.

Edit:
@melindahelt or @securityjedi Do we know if the booking form was a custom form, or the default form? It looks like the default form has a phone number field. If this isn't needed we can hide the field with css, and use it as a honey pot. Bots will fill in the field (humans won't as they can't see it), and we filter them out with the plugin's em_booking_validate hook and a custom function.
If it's a custom form, we can add a custom field to do the same thing.

[nickpagz]

@securityjedi

Hiding location for non-registered users

I had a brief try with only showing the location for registered users. It seems like it might be possible, however we would need some javascript and an AJAX call to check the booking status and set a cookie. We need to use a cookie because registered users aren't necessarily users on the site, so there's no other way to check if a site visitor previously registered. The AJAX call is needed since the form submission uses AJAX and we don't get a page refresh to check for the booking status.
It's a bit more complex than the original css solution, but looks do-able if the css solution isn't acceptable.

Spam submissions to this event (honey pot approach)

The following code snippets should do the trick (event ID shown is for staging site, on prod it is 105). If we confirm we don't need the phone number, I can add this to the site. (On staging, the code is added as a code snippet, and the css is not implemented so it can be tested).

PHP

add_filter('em_booking_validate', 'osi_block_booking_if_phone_filled', 10, 2);

function osi_block_booking_if_phone_filled($result, $EM_Booking) {
	if (!empty($EM_Booking->event) && $EM_Booking->event->event_id == 82) {
    	// Check the field 'dbem_phone'
    	if (isset($_POST['dbem_phone']) && trim($_POST['dbem_phone']) !== '') {
        	$EM_Booking->add_error('There was a problem with your booking. Please do not include a phone number.');
        	return false; // block booking
		}
    }

    return $result;
}

CSS

#em-booking-form-82 p:has(#dbem_phone) {
  display: none;
}

[securityjedi]

Hi @nickpagz,

Thank you for your response.

I've taken a look at the site and I believe that the custom contact form being used is here → [Form Editor link]

It's the Default form under Selected Booking Form.

Booking form

I like the honeypot field idea, let's move ahead with this.

[nickpagz]

@securityjedi Can we get the partner to activate the staging license for Events Manager Pro on the staging site? I can't get the Forms Editor to work without it, and it's too risky to test on production as I still need to determine the keys for the fields when used through the editor.

[securityjedi]

Hi @nickpagz,

The partner has activated the license on the staging site.

Regards,

[nickpagz]

@securityjedi ... and cc'ing @nickvidal and @ajolo2ky given it's Friday evening (for me at least) and you may want to get the booking form up and running asap.

I've added some code to help with a honey pot solution on the booking form. Add any non-required text field with the slug Field ID phone_hp to any custom form as the honey pot. CSS will hide it, and a custom function will stop the form submission if it's filled in. Hopefully this stops the bulk of the spam. See the screenshot below for a visual aid. Note that I've already added this to the "Default" form on the production site. Enable Bookings for the event, choose the second "Default" in the drop down (or any custom form with the honey pot field added) and you should be good to go. This is already merged to both staging and production.

Let me know if there's any issues.

[securityjedi]

Noting that I've sent comms to the partner to move this forward. I'll update this thread with comments.

Regards,

[melindahelt]

This project was paused and documented in https://wpspecialprojectsp2.wordpress.com/2023/03/29/opensource-org/#comment-44441