WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Users: Replace raw SQL query in `check_password_reset_key()` with `get_user_by()`. 

Props davidbaumwald, iworks, spacedmonkey.
Fixes #45845.
Built from https://develop.svn.wordpress.org/trunk@44780


git-svn-id: http://core.svn.wordpress.org/trunk@44612 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Sergey Biryukov 2019-02-28 14:39:50 +00:00
parent e57fcaeeee
commit 43324cec8b
2 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
wp-includes/user.php
View File

@ -2320,8 +2320,9 @@ function check_password_reset_key( $key, $login ) {
return new WP_Error( 'invalid_key', __( 'Invalid key' ) ); return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
} }
$row = $wpdb->get_row( $wpdb->prepare( "SELECT ID, user_activation_key FROM $wpdb->users WHERE user_login = %s", $login ) ); $user = get_user_by( 'login', $login );
if ( ! $row ) {
if ( ! $user ) {
return new WP_Error( 'invalid_key', __( 'Invalid key' ) ); return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
} }
@ -2339,11 +2340,11 @@ function check_password_reset_key( $key, $login ) {
*/ */
$expiration_duration = apply_filters( 'password_reset_expiration', DAY_IN_SECONDS ); $expiration_duration = apply_filters( 'password_reset_expiration', DAY_IN_SECONDS );
if ( false !== strpos( $row->user_activation_key, ':' ) ) { if ( false !== strpos( $user->user_activation_key, ':' ) ) {
list( $pass_request_time, $pass_key ) = explode( ':', $row->user_activation_key, 2 ); list( $pass_request_time, $pass_key ) = explode( ':', $user->user_activation_key, 2 );
$expiration_time = $pass_request_time + $expiration_duration; $expiration_time = $pass_request_time + $expiration_duration;
} else { } else {
$pass_key = $row->user_activation_key; $pass_key = $user->user_activation_key;
$expiration_time = false; $expiration_time = false;
} }
@ -2354,15 +2355,15 @@ function check_password_reset_key( $key, $login ) {
$hash_is_correct = $wp_hasher->CheckPassword( $key, $pass_key ); $hash_is_correct = $wp_hasher->CheckPassword( $key, $pass_key );
if ( $hash_is_correct && $expiration_time && time() < $expiration_time ) { if ( $hash_is_correct && $expiration_time && time() < $expiration_time ) {
return get_userdata( $row->ID ); return $user;
} elseif ( $hash_is_correct && $expiration_time ) { } elseif ( $hash_is_correct && $expiration_time ) {
// Key has an expiration time that's passed // Key has an expiration time that's passed
return new WP_Error( 'expired_key', __( 'Invalid key' ) ); return new WP_Error( 'expired_key', __( 'Invalid key' ) );
} }
if ( hash_equals( $row->user_activation_key, $key ) || ( $hash_is_correct && ! $expiration_time ) ) { if ( hash_equals( $user->user_activation_key, $key ) || ( $hash_is_correct && ! $expiration_time ) ) {
$return = new WP_Error( 'expired_key', __( 'Invalid key' ) ); $return = new WP_Error( 'expired_key', __( 'Invalid key' ) );
$user_id = $row->ID; $user_id = $user->ID;
/** /**
* Filters the return value of check_password_reset_key() when an * Filters the return value of check_password_reset_key() when an

2
wp-includes/version.php
View File

@ -13,7 +13,7 @@
* *
* @global string $wp_version * @global string $wp_version
*/ */
$wp_version = '5.2-alpha-44779'; $wp_version = '5.2-alpha-44780';
/** /**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.