fix(content-gate): prevent metering from bypassing account verification requirement by miguelpeixe · Pull Request #4459 · Automattic/newspack-plugin

miguelpeixe · 2026-02-05T19:36:48Z

All Submissions:

Have you followed the Newspack Contributing guideline?
Does your code follow the WordPress' coding standards and VIP Go coding standards?
Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes proposed in this Pull Request:

The logged-in metering strategy only checks whether the user is logged in to implement its logic, which can bypass the gate's verification requirement.

This PR adds a check to bail out metering when the gate requires verification, and the reader is not verified.

Also introduces unit tests to metering.

How to test the changes in this Pull Request:

While on trunk, create a gate with:
1. "Registered Access" without metering and require account verification
2. "Paid Access" with metering
In an anonymous session, navigate to a restricted article
Register via the gate and confirm you unlock the article on refresh (paid access metering)
Checkout this branch, refresh, and confirm the article remains gated
Verify your account and confirm logged-in metering works

Other information:

Have you added an explanation of what your changes do and why you'd like us to include them?
Have you written new tests for your changes, as applicable?
Have you successfully ran tests with your changes locally?

…on requirement

Copilot

Pull request overview

This PR fixes a security issue where logged-in metering would bypass the account verification requirement. The fix adds a check to prevent metering from allowing access when the gate requires account verification but the reader has not verified their account.

Changes:

Added a new requires_account_verification() method to check if a gate requires account verification
Added a verification check in the metering logic to bail out when verification is required but not completed
Removed unused code (priority variable and comment)

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
includes/content-gate/class-content-gate.php	Adds a helper method to check if account verification is required for a gate
includes/content-gate/class-metering.php	Implements the verification check in logged-in metering logic and removes unused code

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

dkoo

Works! Tests look good too.

github-actions · 2026-02-10T15:28:34Z

Hey @miguelpeixe, good job getting this PR merged! 🎉

Now, the needs-changelog label has been added to it.

Please check if this PR needs to be included in the "Upcoming Changes" and "Release Notes" doc. If it doesn't, simply remove the label.

If it does, please add an entry to our shared document, with screenshots and testing instructions if applicable, then remove the label.

Thank you! ❤️

# [6.33.0-alpha.1](v6.32.0...v6.33.0-alpha.1) (2026-02-19) ### Bug Fixes * add bock theme check before switching templates to prevent warnings ([#4412](#4412)) ([dfb5b63](dfb5b63)) * add check for my account before switching error notice ([#4484](#4484)) ([0cb3ae8](0cb3ae8)) * add fallback selector for the content gate in block theme ([#4431](#4431)) ([dd0b2b1](dd0b2b1)) * **avatar:** show placeholder for text-only custom bylines in editor ([#4456](#4456)) ([56d3278](56d3278)) * **content-gate:** create gate layout with 'publish' status ([#4483](#4483)) ([108215a](108215a)) * **content-gate:** prevent metering from bypassing account verification requirement ([#4459](#4459)) ([90aed19](90aed19)) * **my-account:** hide payment method dropdown if only has one child and is disabled ([#4472](#4472)) ([6e3c3f5](6e3c3f5)) * **my-account:** missing padding on labels ([#4479](#4479)) ([6c6d183](6c6d183)) * tweak inline gate styles for block theme ([#4445](#4445)) ([d867a53](d867a53)) ### Features * **content-gating:** new UI for adding/editing content gates ([#4474](#4474)) ([a193ecc](a193ecc)) * **data-events:** handler retry and ActionScheduler support ([#4469](#4469)) ([c997f38](c997f38)) * integrations - rename classes and move can_sync ([#4451](#4451)) ([877ce4f](877ce4f)) * integrations barebones ([#4433](#4433)) ([79bf9a7](79bf9a7)) * **my-account:** block theme styles ([#4430](#4430)) ([1629465](1629465)) * **my-account:** improve navigation on small screens ([#4471](#4471)) ([3404a66](3404a66)) * **newspack-components:** add divider component ([#4462](#4462)) ([f080d72](f080d72))

github-actions · 2026-02-19T19:49:48Z

🎉 This PR is included in version 6.33.0-alpha.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

# [6.34.0-alpha.1](v6.33.0...v6.34.0-alpha.1) (2026-03-02) ### Bug Fixes * add bock theme check before switching templates to prevent warnings ([#4412](#4412)) ([dfb5b63](dfb5b63)) * add check for my account before switching error notice ([#4484](#4484)) ([0cb3ae8](0cb3ae8)) * add fallback selector for the content gate in block theme ([#4431](#4431)) ([dd0b2b1](dd0b2b1)) * **avatar:** show placeholder for text-only custom bylines in editor ([#4456](#4456)) ([56d3278](56d3278)) * **content-gate:** create gate layout with 'publish' status ([#4483](#4483)) ([108215a](108215a)) * **content-gate:** prevent metering from bypassing account verification requirement ([#4459](#4459)) ([90aed19](90aed19)) * **my-account:** hide payment method dropdown if only has one child and is disabled ([#4472](#4472)) ([6e3c3f5](6e3c3f5)) * **my-account:** missing padding on labels ([#4479](#4479)) ([6c6d183](6c6d183)) * tweak inline gate styles for block theme ([#4445](#4445)) ([d867a53](d867a53)) ### Features * **content-gating:** new UI for adding/editing content gates ([#4474](#4474)) ([a193ecc](a193ecc)) * **data-events:** handler retry and ActionScheduler support ([#4469](#4469)) ([c997f38](c997f38)) * integrations - rename classes and move can_sync ([#4451](#4451)) ([877ce4f](877ce4f)) * integrations barebones ([#4433](#4433)) ([79bf9a7](79bf9a7)) * **my-account:** block theme styles ([#4430](#4430)) ([1629465](1629465)) * **my-account:** improve navigation on small screens ([#4471](#4471)) ([3404a66](3404a66)) * **newspack-components:** add divider component ([#4462](#4462)) ([f080d72](f080d72))

github-actions · 2026-03-02T15:39:51Z

🎉 This PR is included in version 6.34.0-alpha.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

# [6.34.0](v6.33.0...v6.34.0) (2026-03-02) ### Bug Fixes * add bock theme check before switching templates to prevent warnings ([#4412](#4412)) ([dfb5b63](dfb5b63)) * add check for my account before switching error notice ([#4484](#4484)) ([0cb3ae8](0cb3ae8)) * add fallback selector for the content gate in block theme ([#4431](#4431)) ([dd0b2b1](dd0b2b1)) * **avatar:** show placeholder for text-only custom bylines in editor ([#4456](#4456)) ([56d3278](56d3278)) * **content-gate:** create gate layout with 'publish' status ([#4483](#4483)) ([108215a](108215a)) * **content-gate:** prevent metering from bypassing account verification requirement ([#4459](#4459)) ([90aed19](90aed19)) * **my-account:** hide payment method dropdown if only has one child and is disabled ([#4472](#4472)) ([6e3c3f5](6e3c3f5)) * **my-account:** missing padding on labels ([#4479](#4479)) ([6c6d183](6c6d183)) * tweak inline gate styles for block theme ([#4445](#4445)) ([d867a53](d867a53)) ### Features * **content-gating:** new UI for adding/editing content gates ([#4474](#4474)) ([a193ecc](a193ecc)) * **data-events:** handler retry and ActionScheduler support ([#4469](#4469)) ([c997f38](c997f38)) * integrations - rename classes and move can_sync ([#4451](#4451)) ([877ce4f](877ce4f)) * integrations barebones ([#4433](#4433)) ([79bf9a7](79bf9a7)) * **my-account:** block theme styles ([#4430](#4430)) ([1629465](1629465)) * **my-account:** improve navigation on small screens ([#4471](#4471)) ([3404a66](3404a66)) * **newspack-components:** add divider component ([#4462](#4462)) ([f080d72](f080d72))

github-actions · 2026-03-02T18:08:57Z

🎉 This PR is included in version 6.34.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

fix(content-gate): prevent metering from bypassing account verificati…

ac43ea9

…on requirement

miguelpeixe requested a review from a team as a code owner February 5, 2026 19:36

miguelpeixe requested review from Copilot and removed request for a team February 5, 2026 19:36

Copilot started reviewing on behalf of miguelpeixe February 5, 2026 19:37 View session

Copilot AI reviewed Feb 5, 2026

View reviewed changes

Comment thread includes/content-gate/class-metering.php Outdated

Comment thread includes/content-gate/class-metering.php Outdated

fix: check reader and add tests

7c59d3c

miguelpeixe self-assigned this Feb 5, 2026

miguelpeixe added the [Status] Needs Review The issue or pull request needs to be reviewed label Feb 5, 2026

dkoo approved these changes Feb 9, 2026

View reviewed changes

github-actions Bot added [Status] Approved The pull request has been reviewed and is ready to merge and removed [Status] Needs Review The issue or pull request needs to be reviewed labels Feb 9, 2026

miguelpeixe merged commit 90aed19 into trunk Feb 10, 2026
13 checks passed

miguelpeixe deleted the fix/content-gate-require-verification-metering branch February 10, 2026 15:28

github-actions Bot added the needs-changelog label Feb 10, 2026

miguelpeixe removed the needs-changelog label Feb 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(content-gate): prevent metering from bypassing account verification requirement#4459

fix(content-gate): prevent metering from bypassing account verification requirement#4459
miguelpeixe merged 2 commits into
trunkfrom
fix/content-gate-require-verification-metering

miguelpeixe commented Feb 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

dkoo left a comment

Uh oh!

Uh oh!

github-actions Bot commented Feb 10, 2026

Uh oh!

github-actions Bot commented Feb 19, 2026

Uh oh!

github-actions Bot commented Mar 2, 2026

Uh oh!

github-actions Bot commented Mar 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

miguelpeixe commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

All Submissions:

Changes proposed in this Pull Request:

How to test the changes in this Pull Request:

Other information:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

dkoo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Feb 10, 2026

Uh oh!

github-actions Bot commented Feb 19, 2026

Uh oh!

github-actions Bot commented Mar 2, 2026

Uh oh!

github-actions Bot commented Mar 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

miguelpeixe commented Feb 5, 2026 •

edited

Loading