Upstream
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Users: Replace raw SQL query in `check_password_reset_key()` with `get_user_by()`. 

Props davidbaumwald, iworks, spacedmonkey.
Fixes #45845.
Built from https://develop.svn.wordpress.org/trunk@45716


git-svn-id: http://core.svn.wordpress.org/trunk@45527 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Sergey Biryukov 2019-08-01 19:19:55 +00:00
parent ee5e044a2a
commit 65420d3c7a
2 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
wp-includes/user.php
View File

@ -2371,8 +2371,9 @@ function check_password_reset_key( $key, $login ) {
return new WP_Error( 'invalid_key', __( 'Invalid key.' ) );
}
$row = $wpdb->get_row( $wpdb->prepare( "SELECT ID, user_activation_key FROM $wpdb->users WHERE user_login = %s", $login ) );
if ( ! $row ) {
$user = get_user_by( 'login', $login );
if ( ! $user ) {
return new WP_Error( 'invalid_key', __( 'Invalid key.' ) );
}
@ -2390,11 +2391,11 @@ function check_password_reset_key( $key, $login ) {
*/
$expiration_duration = apply_filters( 'password_reset_expiration', DAY_IN_SECONDS );
if ( false !== strpos( $row->user_activation_key, ':' ) ) {
list( $pass_request_time, $pass_key ) = explode( ':', $row->user_activation_key, 2 );
if ( false !== strpos( $user->user_activation_key, ':' ) ) {
list( $pass_request_time, $pass_key ) = explode( ':', $user->user_activation_key, 2 );
$expiration_time = $pass_request_time + $expiration_duration;
} else {
$pass_key = $row->user_activation_key;
$pass_key = $user->user_activation_key;
$expiration_time = false;
}
@ -2405,15 +2406,15 @@ function check_password_reset_key( $key, $login ) {
$hash_is_correct = $wp_hasher->CheckPassword( $key, $pass_key );
if ( $hash_is_correct && $expiration_time && time() < $expiration_time ) {
return get_userdata( $row->ID );
return $user;
} elseif ( $hash_is_correct && $expiration_time ) {
// Key has an expiration time that's passed
return new WP_Error( 'expired_key', __( 'Invalid key.' ) );
}
if ( hash_equals( $row->user_activation_key, $key ) || ( $hash_is_correct && ! $expiration_time ) ) {
if ( hash_equals( $user->user_activation_key, $key ) || ( $hash_is_correct && ! $expiration_time ) ) {
$return = new WP_Error( 'expired_key', __( 'Invalid key.' ) );
$user_id = $row->ID;
$user_id = $user->ID;
/**
* Filters the return value of check_password_reset_key() when an

2
wp-includes/version.php
View File

@ -13,7 +13,7 @@
*
* @global string $wp_version
*/
$wp_version = '5.3-alpha-45715';
$wp_version = '5.3-alpha-45716';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.