Additional Participants are incorrectly added to group set in profile for primary participant
Overview
For an event where additional participants are allowed, where there is a different profile selected for the additional participants than for the primary participant, and there is a group set for "Add contacts to a group?" for the primary participant profile, any additional participants will be added to that group — even when the profile for additional participants is not set to add contacts to a group.
If the profile for additional participants is not set to add contacts to any group, the additional participants will be added to the group for the primary participant profile. If the additional participants profile is set to add contacts to a different group, the additional participants will be added to both groups. This also works the other way as well, so the primary participant will be added to any groups set in additional participant profiles.
This is a significant problem as it can result in contacts being subscribed to newsletters that they have not consented to receive.
Reproduction steps
- Set up two profiles, A adds to a group, B does not add to a group.
- Set up an event that allows additional participant registration, with profile A for the primary participant and profile B for additional participants.
- Register two contacts for the event.
- Only the first contact should be added to the group specified in profile A, but both contacts will be added to the group.
Tested on dmaster (5.54.alpha1) and 5.49.5.
Cause
It appears the issue is here. For each contact, this checks every field in the form, regardless of which profile it is in, and adds the contact to any groups it finds in any of those fields.
Proposed fix
For each contact, check if registered_by_id exists in $params. If no, this is the primary participant. Check $form for custom_pre_id and custom_post_id (array) to get a list of profiles used. If yes, this is an additional participant. Check $form for additional_custom_pre_id and additional_custom_post_id (array, if exists) to get a list of profiles used. For each profile, check the API for an add_to_group_id and add it to $addToGroups if one exists. $form does include all fields from all profiles with add_to_group_id for each, but it seems cleaner to look this up rather than checking though a potentially long list of fields, I think.