diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php index 85bac11c2c..fe6bbd7046 100644 --- a/wp-includes/pluggable.php +++ b/wp-includes/pluggable.php @@ -1136,7 +1136,10 @@ function wp_password_change_notification(&$user) { // but check to see if it's the admin whose password we're changing, and skip this if ( $user->user_email != get_option('admin_email') ) { $message = sprintf(__('Password Lost and Changed for user: %s'), $user->user_login) . "\r\n"; - wp_mail(get_option('admin_email'), sprintf(__('[%s] Password Lost/Changed'), @html_entity_decode(get_option('blogname'), ENT_QUOTES, get_option('blog_charset'))), $message); + // The blogname option is escaped with esc_html on the way into the database in sanitize_option + // we want to reverse this for the plain text arena of emails. + $blogname = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES); + wp_mail(get_option('admin_email'), sprintf(__('[%s] Password Lost/Changed'), $blogname), $message); } } endif; diff --git a/wp-login.php b/wp-login.php index 44a17604ef..a20e6ffec2 100644 --- a/wp-login.php +++ b/wp-login.php @@ -167,7 +167,11 @@ function retrieve_password() { $message .= __('To reset your password visit the following address, otherwise just ignore this email and nothing will happen.') . "\r\n\r\n"; $message .= site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . "\r\n"; - $title = sprintf(__('[%s] Password Reset'), get_option('blogname')); + // The blogname option is escaped with esc_html on the way into the database in sanitize_option + // we want to reverse this for the plain text arena of emails. + $blogname = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES); + + $title = sprintf(__('[%s] Password Reset'), $blogname); $title = apply_filters('retrieve_password_title', $title); $message = apply_filters('retrieve_password_message', $message, $key); @@ -212,7 +216,11 @@ function reset_password($key, $login) { $message .= sprintf(__('Password: %s'), $new_pass) . "\r\n"; $message .= site_url('wp-login.php', 'login') . "\r\n"; - $title = sprintf(__('[%s] Your new password'), get_option('blogname')); + // The blogname option is escaped with esc_html on the way into the database in sanitize_option + // we want to reverse this for the plain text arena of emails. + $blogname = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES); + + $title = sprintf(__('[%s] Your new password'), $blogname); $title = apply_filters('password_reset_title', $title); $message = apply_filters('password_reset_message', $message, $new_pass);