From 720e2af2903fa758600857f48bcf4dc59dc97842 Mon Sep 17 00:00:00 2001 From: Boone Gorges Date: Fri, 20 May 2016 19:21:30 +0000 Subject: [PATCH] During password reset, user-submitted login/email should be stripslashed. This prevents errors when an email address contains an apostrophe. See [29966] for similar treatment of a related problem. Props dcavins. Fixes #36322. Built from https://develop.svn.wordpress.org/trunk@37474 git-svn-id: http://core.svn.wordpress.org/trunk@37442 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/version.php | 2 +- wp-login.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/wp-includes/version.php b/wp-includes/version.php index 3dcc84b7a0..c6464d62c6 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -4,7 +4,7 @@ * * @global string $wp_version */ -$wp_version = '4.6-alpha-37473'; +$wp_version = '4.6-alpha-37474'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. diff --git a/wp-login.php b/wp-login.php index 96eef5b27d..1c2428217f 100644 --- a/wp-login.php +++ b/wp-login.php @@ -294,7 +294,7 @@ function retrieve_password() { if ( empty( $_POST['user_login'] ) ) { $errors->add('empty_username', __('ERROR: Enter a username or email address.')); } elseif ( strpos( $_POST['user_login'], '@' ) ) { - $user_data = get_user_by( 'email', trim( $_POST['user_login'] ) ); + $user_data = get_user_by( 'email', trim( wp_unslash( $_POST['user_login'] ) ) ); if ( empty( $user_data ) ) $errors->add('invalid_email', __('ERROR: There is no user registered with that email address.')); } else {