Don't email the admin when they create a user from the backend

[caesarsgrunt]

I just created the user myself. I already know I did it. I don't need to be told again.

Emails should only be sent to the admin when a user registers themselves (if that is enabled). They shouldn't be sent when the admin manually creates a new user.

[nacin]

What about a site with multiple admins? More importantly, the admin_email isn't tied directly to a user account, so you'd have to compare the admin_email with the current user email, that way if the admin_email isn't the current user's, it can still be sent.

Perhaps wp_new_user_notification, as a pluggable function, could use an extra parameter specifying whether it came from wp-login.php or wp-admin?

See also #11210.

[lloydbudd]

Recommend closing as won't fix at this time.

Consistent, low friction... also as nacin describes "multiple admins" -- blog owner/admin is weak concept in WordPress. I don't think we should tweak it.

Functions are already pluggable.

PS. caesarsgrunt, please always include your specific build when setting the version to the current trunk version.

[nacin]

Seems like wontfix, though the attached patch might not be a bad idea.

[lloydbudd]

Replying to nacin:

Seems like wontfix, though the attached patch might not be a bad idea.

nacin, maybe throw the patch in it's own ticket, describing that solves the problem of being able to filter based on $context.

[nacin]

Replying to lloydbudd:

nacin, maybe throw the patch in it's own ticket, describing that solves the problem of being able to filter based on $context.

I could, but this patch would directly facilitate a solution for this via a plugin. A new ticket here just bloats Trac IMHO.

[lloydbudd]

Replying to nacin:

Replying to lloydbudd:

nacin, maybe throw the patch in it's own ticket, describing that solves the problem of being able to filter based on $context.

I could, but this patch would directly facilitate a solution for this via a plugin. A new ticket here just bloats Trac IMHO.

Which ever you prefer.

A concise problem + solution makes it easier for other to find, and encourages by example well written ticket submission.

[caesarsgrunt]

Replying to nacin:

What about a site with multiple admins? More importantly, the admin_email isn't tied directly to a user account, so you'd have to compare the admin_email with the current user email, that way if the admin_email isn't the current user's, it can still be sent.

Well, perhaps we'd also have to change that to fix this (and #11277).

I'm not sure if the email needs sending even in the event of multiple admins, but i it does then perhaps we could do it by either (a) checking the addresses and not sending to the address of the current user, or (b) removing the admin email field in Settings and emailing each admin instead using their profile email address. This is tidier anyway; having the same data in two places is redundant.

Replying to lloydbudd:

PS. caesarsgrunt, please always include your specific build when setting the version to the current trunk version.

I do when it's relevant, but in this case it isn't really. I can anyway if you like... (FWIW, this still applies in 12312.)

[chriscct7]

Core should review whether they want this. Last time, Nacin was against in comment 1

[jeremyfelt]

#33587 added a context param to the pluggable wp_new_user_notification(), though we only handle a case for (1) admin emails only or (2) admin and new user.

We could also wrap the email to the admin and provide for 4 context possibilities - user only, admin only, both, or none. This would allow someone to unhook/rehook notifications up with a different wrapper than wp_send_new_user_notification() and thus context.

Pinging @boonebgorges for his thoughts as he was deep in the weeds of #33587.

[boonebgorges]

@jeremyfelt I lean thumbs-down on this ticket. As @nacin notes, a site could have more than one admin, and it makes sense for all to be notified when a new user is created. The fact that the notification is now sent via callback means that it can be selectively unhooked if it's deemed redundant for a given site.

[candacejohnsondesigns]

To reinforce security practices, I think that this ticket should be closed and not pursued. Beyond just confirmation of the creation of a new user, an email would notify the admin(s) of potential security breaches— phishing or hacking— that resulted in an unauthorized person creating other users.

[joemcgill]

Was reviewing this ticket at Contributor Day today with @candacejohnsondesigns and agree that this should be closed as a wontfix. Also, since this has been open for so long with no forward movement, this doesn't seem like something we want to fix.