From 9a4cbd05e8c5d93dfdbe9295a46e5e54322b6f56 Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov.ru@gmail.com>
Date: Tue, 23 Feb 2021 20:08:03 +0000
Subject: [PATCH] Users: Only include the IP address in password reset email if
 the user is not logged in.

This avoids unnecessarily disclosing the IP address when sending a password reset link to another user from the admin.

Follow-up to [49255], [50129].

Props carike, audrasjb, gmariani405, Ipstenu.
See #34281.
Built from https://develop.svn.wordpress.org/trunk@50422


git-svn-id: http://core.svn.wordpress.org/trunk@50033 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/user.php    | 16 +++++++++-------
 wp-includes/version.php |  2 +-
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/wp-includes/user.php b/wp-includes/user.php
index 0ea54f1a52..ce43a159b1 100644
--- a/wp-includes/user.php
+++ b/wp-includes/user.php
@@ -2773,13 +2773,15 @@ function retrieve_password( $user_login = null ) {
 	$message .= __( 'To reset your password, visit the following address:' ) . "\r\n\r\n";
 	$message .= network_site_url( "wp-login.php?action=rp&key=$key&login=" . rawurlencode( $user_login ), 'login' ) . "\r\n\r\n";
 
-	$requester_ip = $_SERVER['REMOTE_ADDR'];
-	if ( $requester_ip ) {
-		$message .= sprintf(
-			/* translators: %s: IP address of password reset requester. */
-			__( 'This password reset request originated from the IP address %s.' ),
-			$requester_ip
-		) . "\r\n";
+	if ( ! is_user_logged_in() ) {
+		$requester_ip = $_SERVER['REMOTE_ADDR'];
+		if ( $requester_ip ) {
+			$message .= sprintf(
+				/* translators: %s: IP address of password reset requester. */
+				__( 'This password reset request originated from the IP address %s.' ),
+				$requester_ip
+			) . "\r\n";
+		}
 	}
 
 	/* translators: Password reset notification email subject. %s: Site title. */
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 27e1249657..b22e1f7670 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -13,7 +13,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '5.7-beta3-50421';
+$wp_version = '5.7-beta3-50422';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.