Feature: Save google profile picture of the user during first login for both the new and existing users by mi5t4n · Pull Request #250 · rtCamp/login-with-google

mi5t4n · 2025-05-05T13:26:32Z

Description

This PR implements saving the user’s Google profile picture for both new and existing users, with slightly different handling for each case.

User Settings

Two new user options have been introduced:

Profile Picture Source
Google Profile Picture Thumbnail

New User

Retrieve and process the Google profile picture.
Download and save it as a WordPress attachment.
Update user meta with the saved attachment ID.
Set the Profile Picture Source to Google.

Kazam_screencast_00004.mp4

Existing User

Check if a Google profile picture has already been downloaded and associated with the user.
If not already downloaded, retrieve and download the Google profile picture.
Save the downloaded image as an attachment.
Update the user meta with the new attachment ID.

Kazam_screencast_00003.mp4

Notice

If a Google profile picture already exists for a user but the Profile Picture Source is not set to Google, an admin notice is displayed:

New Filters Added

Bypass profile picture saving

login-with-google/src/Utils/Authenticator.php

Lines 202 to 212 in df906b2

    
           		/** 
        
           		 * Filter to bypass the profile picture saving process. 
        
           		 * 
        
           		 * @since n.e.x.t 
        
           		 * 
        
           		 * @param boolean $save Whether to save profile picture or not. 
        
           		 * @param int $user_id WP User ID. 
        
           		 * @param \stdClass $user User object returned by Google. 
        
           		 */ 
        
           		$save_profile_picture = apply_filters( 'rtcamp.google_should_save_user_profile_picture', true, $user_id, $user );

Enables re-downloading the Google profile picture regardless of existing attachments.

login-with-google/src/Utils/Authenticator.php

Lines 235 to 249 in df906b2

    
           		/** 
        
           		 * Filter to download profile picture even if it is not already downloaded. 
        
           		 * 
        
           		 * @since n.e.x.t 
        
           		 * 
        
           		 * @param boolean $download_profile_picture Whether to download profile picture. 
        
           		 * @param int $user_id WP User ID. 
        
           		 * @param \stdClass $user User object returned by Google. 
        
           		 */ 
        
           		$download_profile_picture = apply_filters( 
        
           			'rtcamp.google_download_profile_picture', 
        
           			! $user_has_google_profile_picture, 
        
           			$user_id, 
        
           			$user 
        
           		);

Note

The rtcamp.google_download_profile_picture filter can be used to sync a user’s latest Google profile picture.

Closes - #249

rtBot

Code analysis identified issues

action-phpcs-code-review has identified potential problems in this pull request during automated scanning. We recommend reviewing the issues noted and that they are resolved.

phpcs scanning turned up:

🚫 1 error

Powered by rtCamp's GitHub Actions Library

Dismissing review as all inline comments are obsolete by now

SH4LIN

"You can change your profile picture on Gravatar."

Wouldn't this be confusing? Currently, the feature only updates the image during registration. We should either periodically check for updates, add a button to re-sync the image, or enhance the feature to also check the profile image during login.

I'm testing the .tmp case for download_url() and will submit feedback after some time.

SH4LIN · 2025-05-06T10:40:56Z

+		// Using larger image size. By default, profile picture has 96 width size with cropped.
+		$profile_picture_url = str_replace( '=s96-c', '', $user->picture );
+
+		$profile_picture_filename = download_url( $profile_picture_url );


Can we add a check for WPVIP? and if the site is hosted on WPVIP we directly use wpcom_vip_download_image() this function.

@SH4LIN Yes, it can be a bit unclear—I’ll look into it further to make it more straightforward. As for re-syncing the image at each login, should we also extend this to include the First Name and Last Name, since those fields can also be updated?

@SH4LIN Regarding vip check, that is a good catch. I will promptly implement this.

should we also extend this to include the First Name and Last Name, since those fields can also be updated?

In WordPress, we have the option to update the first name and last name. So, if they want to customize it, they can do so from the settings. However, there is no option in the WordPress dashboard to change the image.

Can we add a check for WPVIP? and if the site is hosted on WPVIP we directly use wpcom_vip_download_image() this function.

I tried to use this function, it seems it won't work in our scenario. I got the following error while trying to use it .

The function was expecting a POST request, but Google calls the redirect URL using the GET method instead. We could try to change the global variables to make it work, but that would be a hacky solution. So, I decided to remove the function for now.

SH4LIN

Hi @mi5t4n,

From what I can see in the implementation of media_handle_sideload(), it appears to handle the .tmp file case as well. Is there a specific reason we’ve added this case explicitly?

Also, I noticed that wpcom_vip_download_image() doesn’t seem to account for this scenario—just wanted to highlight that for consistency.

Thanks!

mi5t4n · 2025-05-07T15:04:49Z

@SH4LIN In my test cases, media_handle_sideload() wasn't handling the temporary files correctly. Even though the MIME types were valid, it rejected the files because they had a .tmp extension, resulting in the error: "You are not allowed to upload the given file type." When the correct extension was set to the file according it's mime type, it worked.

SH4LIN · 2025-05-07T15:51:57Z

@SH4LIN In my test cases, media_handle_sideload() wasn't handling the temporary files correctly. Even though the MIME types were valid, it rejected the files because they had a .tmp extension, resulting in the error: "You are not allowed to upload the given file type." When the correct extension was set to the file according it's mime type, it worked.

If that's the case then another option is this, we identify mime, and ext from our end pass it to the file array with key type and ext. Can we check whether this solution works or not.

SH4LIN

@mi5t4n We will also need to update the docs with the newly added hooks.

…g-account-creation

mi5t4n · 2025-05-15T15:27:52Z

"You can change your profile picture on Gravatar."

Wouldn't this be confusing? Currently, the feature only updates the image during registration. We should either periodically check for updates, add a button to re-sync the image, or enhance the feature to also check the profile image during login.

At the moment, I can think of two ways to make it better.

Override the defaule Profile Picture section to handle the removal and upload of the picture.

Before:

After:

Create a new section called Google Profile Picture and a global setting to override the default avatar.

LMK your thoughts on this.

cc @SH4LIN @joelabreo227

mi5t4n · 2025-05-16T05:53:15Z

@SH4LIN In my test cases, media_handle_sideload() wasn't handling the temporary files correctly. Even though the MIME types were valid, it rejected the files because they had a .tmp extension, resulting in the error: "You are not allowed to upload the given file type." When the correct extension was set to the file according it's mime type, it worked.

If that's the case then another option is this, we identify mime, and ext from our end pass it to the file array with key type and ext. Can we check whether this solution works or not.

I'm not sure why, but during my second test, the .tmp files were no longer created. Now, every profile picture is saved with the correct file extension. Also, we can provide the MIME type, but not the file extension directly — the extension comes from the filename itself. The media_handle_sideload() function throws an error if the file extension doesn’t match the MIME type.

…g-account-creation

Copilot

Pull Request Overview

This PR adds functionality to save and use Google profile pictures for user avatars. When users register via Google login, their profile picture is downloaded and stored as a WordPress media attachment, then used as their avatar throughout the site.

Adds profile picture saving during user registration with a filter to bypass the process
Implements avatar URL override to use stored Google profile pictures instead of Gravatar
Extracts profile picture saving logic into a reusable private method

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 8 comments.

File	Description
src/Utils/Authenticator.php	Adds `save_user_profile_picture()` method to download and store Google profile pictures during registration, with filter hook to bypass
src/Plugin.php	Adds `return_avatar_url()` method hooked to `get_avatar_url` filter to replace Gravatar with stored profile pictures

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 9 comments.

Comments suppressed due to low confidence (1)

src/Utils/Authenticator.php:224

Security concern: The profile picture URL from Google is used directly without validation. While Google is a trusted source, it's a best practice to validate that the URL is actually from Google's domain before downloading to prevent potential SSRF (Server-Side Request Forgery) attacks if the $user->picture field is somehow manipulated.

Consider adding URL validation:

if ( ! isset( $user->picture ) || empty( $user->picture ) ) {
    return;
}

// Validate it's a Google URL
$parsed_url = wp_parse_url( $user->picture );
if ( ! $parsed_url || ! isset( $parsed_url['host'] ) || 
     ! preg_match( '/^([a-z0-9-]+\.)*googleusercontent\.com$/i', $parsed_url['host'] ) ) {
    return;
}

		if ( ! isset( $user->picture ) || empty( $user->picture ) ) {
			return;
		}

		// Using larger image size. By default, profile picture has 96 width size with cropped.
		$profile_picture_url = str_replace( '=s96-c', '', $user->picture );

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 18 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-10T11:52:31Z

+	 * @return integer|null
+	 */
+	public static function get_saved_google_profile_picture_id( int $user_id ): ?int {
+		$profile_picture_id = get_user_meta( $user_id, 'rtlwg_profile_picture_id', true );


Same inconsistency in the meta key prefix. Uses rtlwg_profile_picture_id while other meta keys use rtlg_ prefix.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

rtBot

Code analysis identified issues

action-phpcs-code-review has identified potential problems in this pull request during automated scanning. We recommend reviewing the issues noted and that they are resolved.

phpcs scanning turned up:

🚫 1 error

Powered by rtCamp's GitHub Actions Library

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

rtBot

Code analysis identified issues

action-phpcs-code-review has identified potential problems in this pull request during automated scanning. We recommend reviewing the issues noted and that they are resolved.

phpcs scanning turned up:

🚫 1 error

Powered by rtCamp's GitHub Actions Library

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Feature: Save google profile picture during account creation

ed17145

mi5t4n self-assigned this May 5, 2025

mi5t4n requested a review from SH4LIN May 5, 2025 13:26

rtBot previously requested changes May 5, 2025

View reviewed changes

Comment thread src/Utils/Authenticator.php Outdated

fix: phpcs errors

573693b

mi5t4n requested a review from rtBot May 5, 2025 13:32

SH4LIN reviewed May 7, 2025

View reviewed changes

SH4LIN reviewed May 8, 2025

View reviewed changes

Merge branch 'develop' into feature/save-google-profile-picture-durin…

cdb6f84

…g-account-creation

Check for wp_filesystem as well

63a2c9b

mi5t4n mentioned this pull request May 5, 2025

Update Account Creation Workflow to Capture and Save Google Profile Image #249

Open

Merge branch 'develop' into feature/save-google-profile-picture-durin…

86f6ffc

…g-account-creation

Copilot AI review requested due to automatic review settings November 6, 2025 07:59

Copilot AI reviewed Nov 6, 2025

View reviewed changes

mi5t4n and others added 6 commits December 3, 2025 14:44

fix: typo

489c68b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Remove leading forward slash

0479da9

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

fix: typo

7bc0631

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

refactor

f01033a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

added error handling

c6659bb

handle empty user picture field from the response

877990d

mi5t4n requested a review from Copilot December 3, 2025 09:15

Copilot started reviewing on behalf of mi5t4n December 3, 2025 09:15 View session

Copilot finished reviewing on behalf of mi5t4n December 3, 2025 09:19

Copilot AI reviewed Dec 3, 2025

View reviewed changes

mi5t4n added 2 commits December 10, 2025 16:52

show user can set the google profile picture notice

458e84c

fix: typo

df906b2

mi5t4n changed the title ~~Feature: Save google profile picture of the user during account creation~~ Feature: Save google profile picture of the user during first login Dec 10, 2025

mi5t4n changed the title ~~Feature: Save google profile picture of the user during first login~~ Feature: Save google profile picture of the user during first login for both the new and existing users Dec 10, 2025

mi5t4n added 2 commits December 10, 2025 17:15

do not display notice if google picture doesn't exists

bcf6db9

fix: phpcs errors

1e6f6f7

mi5t4n requested review from Copilot and rtBot December 10, 2025 11:40

Copilot started reviewing on behalf of mi5t4n December 10, 2025 11:44 View session

Copilot AI reviewed Dec 10, 2025

View reviewed changes

Apply suggestions from code review

964f6cf

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

rtBot requested changes Dec 10, 2025

View reviewed changes

Comment thread src/Utils/UserProfileHelper.php

mi5t4n and others added 2 commits December 10, 2025 17:42

Update src/Modules/UserProfile.php

2f04b1f

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update src/Modules/UserProfile.php

b651a08

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

rtBot requested changes Dec 10, 2025

View reviewed changes

Comment thread src/Modules/UserProfile.php

mi5t4n added 3 commits December 10, 2025 17:44

fix: prefix

9d4693d

fix: phpcs errors

d53d4f8

fix: phpcs errors

f94397e

mi5t4n requested review from Copilot and rtBot December 10, 2025 12:03

Copilot started reviewing on behalf of mi5t4n December 10, 2025 12:03 View session

Copilot AI reviewed Dec 10, 2025

View reviewed changes

mi5t4n and others added 4 commits December 10, 2025 17:57

Update src/Utils/Authenticator.php

268d19b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update src/Modules/UserProfile.php

c1b6635

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update src/Modules/UserProfile.php

9a5a33b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update src/Modules/UserProfile.php

e1f2707

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

mi5t4n requested a review from mchirag2002 December 10, 2025 12:16

mi5t4n added 3 commits December 11, 2025 14:49

fix: pcp errors

3f975d5

added more parameters to the filter

596427b

updated the readme.md with new filters

f45b753


	/**
	* Filter to bypass the profile picture saving process.
	*
	* @since n.e.x.t
	*
	* @param boolean $save Whether to save profile picture or not.
	* @param int $user_id WP User ID.
	* @param \stdClass $user User object returned by Google.
	*/
	$save_profile_picture = apply_filters( 'rtcamp.google_should_save_user_profile_picture', true, $user_id, $user );

	/**
	* Filter to download profile picture even if it is not already downloaded.
	*
	* @since n.e.x.t
	*
	* @param boolean $download_profile_picture Whether to download profile picture.
	* @param int $user_id WP User ID.
	* @param \stdClass $user User object returned by Google.
	*/
	$download_profile_picture = apply_filters(
	'rtcamp.google_download_profile_picture',
	! $user_has_google_profile_picture,
	$user_id,
	$user
	);

Conversation

mi5t4n commented May 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

User Settings

New User

Existing User

Notice

New Filters Added

Uh oh!

rtBot left a comment

Choose a reason for hiding this comment

Code analysis identified issues

Uh oh!

Uh oh!

SH4LIN left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SH4LIN May 6, 2025

Choose a reason for hiding this comment

Uh oh!

mi5t4n May 7, 2025

Choose a reason for hiding this comment

Uh oh!

mi5t4n May 7, 2025

Choose a reason for hiding this comment

Uh oh!

SH4LIN May 8, 2025

Choose a reason for hiding this comment

Uh oh!

mi5t4n May 16, 2025

Choose a reason for hiding this comment

Uh oh!

SH4LIN left a comment

Choose a reason for hiding this comment

Uh oh!

mi5t4n commented May 7, 2025

Uh oh!

SH4LIN commented May 7, 2025

Uh oh!

SH4LIN left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mi5t4n commented May 15, 2025

Uh oh!

mi5t4n commented May 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

mi5t4n commented May 5, 2025 •

edited

Loading

SH4LIN left a comment •

edited

Loading

SH4LIN left a comment •

edited

Loading

mi5t4n commented May 16, 2025 •

edited

Loading