Final version bump to v5.2.4 for public release.

Author: y000yal

CHANGELOG.txt

@@ -1,3 +1,20 @@
+= 5.2.4    - 25/06/2026 =
+* Enhance  - User role overwritten on new membership assignment.
+* Enhance  - Add customizable membership registration success message in settings.
+* Fix      - Duplicate variable.
+* Fix      - Invoice dynamic content not translatable.
+* Fix      - Missing users in user registration members section.
+* Fix      - Validation of key while saving the stripe payment settings.
+* Fix      - My Account payment tab pulling footer content inside the tab area.
+* Fix      - Address incomplete PayPal setup error when adding PayPal for old user.
+* Fix      - hCaptcha enabled on registration form blocks users from completing signup.
+* Fix      - Reset content button not working in the prevent concurrent login email template.
+* Fix      - New Member Registered email not sent when Admin Approval Request email is enabled.
+* Fix      - Harden membership coupon apply paths against PHP 8 TypeError (free membership module).
+* Fix      - File upload attachments not updating correctly when admin edits another user's profile.
+* Fix      - Registration failure causes missing member records and prevents Stripe payment processing.
+
+
 = 5.2.3    - 23/06/2026 =
 * Fix      - validation for receiver email and payment amount in PayPal IPN handling.
 * Fix      - Selected membership tier during registration missed proper validation, allowing assignment of off-form membership tiers.

assets/js/admin/form-modal.js

@@ -18,6 +18,7 @@
 		// Sweetalert modal popup on reset content clicked.
 		$(document).on("click", ".ur-reset-content-button", function (event) {
 			event.preventDefault();
+			var editorIdFromButton = $(this).data("editor");
 			Swal.fire({
 				title: "Reset to Default",
 				text: "Are you sure you want to reset the email content to the default?",
@@ -31,28 +32,61 @@
 					var params = new URLSearchParams(window.location.search);
 					var section = params.get("section");
 					if (section) {
-						var selector = section.replace(
+						var baseSelector = section.replace(
 							/^ur_settings_/,
 							"user_registration_"
 						);
-						var editor =
-							typeof tinymce !== "undefined"
-								? tinymce.get(selector)
-								: null;
+						// Resolve the actual editor/textarea id. Prefer the
+						// data-editor attribute on the button, then fall back
+						// to the base selector (existing emails), then to the
+						// base + "_content" (newer emails like prevent
+						// concurrent login).
+						var candidates = [];
+						if (editorIdFromButton) {
+							candidates.push(editorIdFromButton);
+						}
+						candidates.push(baseSelector);
+						candidates.push(baseSelector + "_content");
+
+						var selector = null;
+						var editor = null;
+						for (var i = 0; i < candidates.length; i++) {
+							var candidate = candidates[i];
+							var candidateEditor =
+								typeof tinymce !== "undefined"
+									? tinymce.get(candidate)
+									: null;
+							if (candidateEditor) {
+								selector = candidate;
+								editor = candidateEditor;
+								break;
+							}
+							if ($("textarea#" + candidate).length) {
+								selector = candidate;
+								break;
+							}
+						}
+
+						if (!selector) {
+							return;
+						}
+
+						var defaultContent =
+							user_registration_email_settings &&
+							user_registration_email_settings[section];
+						if (typeof defaultContent === "undefined") {
+							return;
+						}
+
 						if (editor && !editor.isHidden()) {
-							var content = user_registration_email_settings[
-								section
-							]
+							var content = defaultContent
 								.replace(/\n\n/g, "<br>")
 								.replace(/\t/g, "");
 							editor.setContent(content);
 						} else {
 							var $textarea = $("textarea#" + selector);
 							if ($textarea.length) {
-								var content = user_registration_email_settings[
-									section
-								].replace(/\t/g, "");
-								$textarea.val(content);
+								$textarea.val(defaultContent.replace(/\t/g, ""));
 							}
 						}
 					}

assets/js/admin/form-modal.min.js

@@ -1748,6 +1748,27 @@
 			section_data[name] = value;
 		});
 
+		if ( setting_id === "stripe" ) {
+			var testPubKey = section_data["user_registration_stripe_test_publishable_key"] || "";
+			var livePubKey = section_data["user_registration_stripe_live_publishable_key"] || "";
+
+			if ( testPubKey && testPubKey.indexOf( "pk_test_" ) !== 0 ) {
+				$this.find( ".ur-spinner" ).remove();
+				show_failure_message(
+					user_registration_settings_params.i18n.invalid_stripe_test_publishable_key
+				);
+				return;
+			}
+
+			if ( livePubKey && livePubKey.indexOf( "pk_live_" ) !== 0 ) {
+				$this.find( ".ur-spinner" ).remove();
+				show_failure_message(
+					user_registration_settings_params.i18n.invalid_stripe_live_publishable_key
+				);
+				return;
+			}
+		}
+
 		update_payment_section_settings(
 			setting_id,
 			section_data,

assets/js/admin/settings.js

@@ -73,17 +73,24 @@ var createDedicatedHcaptchaLoader = function() {
 			return 'hcaptcha-loading';
 		},
 		reset: function(widgetId) {
-			if (window.hcaptcha && window.hcaptcha.reset) {
-				window.hcaptcha.reset(widgetId);
-			}
+			// widgetId is a string placeholder ('hcaptcha-loading') until the
+			// real widget has rendered; resetting with it throws and aborts
+			// submission, so only reset a real (numeric) widget id and never throw.
+			try {
+				if (window.hcaptcha && window.hcaptcha.reset && typeof widgetId !== 'string') {
+					window.hcaptcha.reset(widgetId);
+				}
+			} catch (e) {}
 		},
 		execute: function(siteKey, options) {
-			if (window.hcaptcha && window.hcaptcha.execute) {
-				window.hcaptcha.execute(siteKey, options);
-			}
+			try {
+				if (window.hcaptcha && window.hcaptcha.execute) {
+					window.hcaptcha.execute(siteKey, options);
+				}
+			} catch (e) {}
 		},
 		getResponse: function(widgetId) {
-			if (window.hcaptcha && window.hcaptcha.getResponse) {
+			if (window.hcaptcha && window.hcaptcha.getResponse && typeof widgetId !== 'string') {
 				return window.hcaptcha.getResponse(widgetId);
 			}
 			return '';
@@ -140,17 +147,23 @@ var createDedicatedRecaptchaLoader = function() {
 			return 'recaptcha-loading';
 		},
 		reset: function(widgetId) {
-			if (window.grecaptcha && window.grecaptcha.reset) {
-				window.grecaptcha.reset(widgetId);
-			}
+			// Skip the 'recaptcha-loading' placeholder id and never throw, so a
+			// captcha reset can't abort form submission.
+			try {
+				if (window.grecaptcha && window.grecaptcha.reset && typeof widgetId !== 'string') {
+					window.grecaptcha.reset(widgetId);
+				}
+			} catch (e) {}
 		},
 		execute: function(siteKey, options) {
-			if (window.grecaptcha && window.grecaptcha.execute) {
-				window.grecaptcha.execute(siteKey, options);
-			}
+			try {
+				if (window.grecaptcha && window.grecaptcha.execute) {
+					window.grecaptcha.execute(siteKey, options);
+				}
+			} catch (e) {}
 		},
 		getResponse: function(widgetId) {
-			if (window.grecaptcha && window.grecaptcha.getResponse) {
+			if (window.grecaptcha && window.grecaptcha.getResponse && typeof widgetId !== 'string') {
 				return window.grecaptcha.getResponse(widgetId);
 			}
 			return '';
@@ -288,6 +301,12 @@ var backupOriginalGlobals = function() {
 // Function to load fresh reCAPTCHA when all backups are hCaptcha
 var freshRecaptchaLoading = false;
 var loadFreshRecaptcha = function() {
+	// Only pull in Google reCAPTCHA when it is actually the configured captcha.
+	// Loading it on an hCaptcha-only form adds a second SDK whose compat shim
+	// then conflicts on window.grecaptcha. (Both v2 and v3 use ur_recaptcha_code.)
+	if (typeof ur_recaptcha_code === 'undefined' || !ur_recaptcha_code.site_key) {
+		return;
+	}
 	if (typeof window.ur_fresh_grecaptcha === 'undefined' && !freshRecaptchaLoading) {
 		freshRecaptchaLoading = true;
 		var script = document.createElement('script');
@@ -397,10 +416,12 @@ var protectGrecaptcha = function() {
 				}
 			});
 
+			// Keep this writable/configurable: locking it down makes hCaptcha's
+			// grecaptcha compat shim throw "Cannot assign to read only property".
 			Object.defineProperty(window, 'grecaptcha', {
 				value: grecaptchaProxy,
-				writable: false,
-				configurable: false
+				writable: true,
+				configurable: true
 			});
 		} catch (e) {
 			// Silent fail

assets/js/admin/settings.min.js

@@ -1160,7 +1160,7 @@
 									var captchaResponse = "";
 									var registration_language = "";
 									if (
-										"hcaptcha" ===
+										"hCaptcha" ===
 										user_registration_params.recaptcha_type
 									) {
 										captchaResponse = $this

assets/js/frontend/user-registration-recaptcha.js

@@ -258,6 +258,8 @@ function initMultiselectV2() {
 					'pro_install_popup_title'            => esc_html__( 'Install User Registration & Membership Pro to Unlock All Features', 'user-registration' ),
 					'will_install_and_activate_pro_text' => esc_html__( 'This will automatically install and activate the User Registration & Membership Pro Plugin for you.', 'user-registration' ),
 					'installing_plugin_text'             => esc_html__( 'Installing Plugin', 'user-registration' ),
+					'invalid_stripe_test_publishable_key' => esc_html__( 'Invalid Stripe test publishable key. It must start with pk_test_.', 'user-registration' ),
+					'invalid_stripe_live_publishable_key' => esc_html__( 'Invalid Stripe live publishable key. It must start with pk_live_.', 'user-registration' ),
 					'pro_activated_success_title'        => esc_html__( 'Success!', 'user-registration' ),
 					'pro_activated_success_text'         => esc_html__( 'URM Pro has been successfully installed and activated. You now have access to all premium features!', 'user-registration' ),
 					'continue_to_dashboard_text'         => esc_html__( 'Continue to dashboard', 'user-registration' ),