WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Users: Only include the IP address in password reset email if the user is not logged in. 

This avoids unnecessarily disclosing the IP address when sending a password reset link to another user from the admin.

Follow-up to [49255], [50129].

Props carike, audrasjb, gmariani405, Ipstenu.
See #34281.
Built from https://develop.svn.wordpress.org/trunk@50422


git-svn-id: http://core.svn.wordpress.org/trunk@50033 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Sergey Biryukov 2021-02-23 20:08:03 +00:00
parent d36527ef68
commit 9a4cbd05e8
2 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
wp-includes/user.php
View File

@ -2773,13 +2773,15 @@ function retrieve_password( $user_login = null ) {
$message .= __( 'To reset your password, visit the following address:' ) . "\r\n\r\n";
$message .= network_site_url( "wp-login.php?action=rp&key=$key&login=" . rawurlencode( $user_login ), 'login' ) . "\r\n\r\n";
$requester_ip = $_SERVER['REMOTE_ADDR'];
if ( $requester_ip ) {
$message .= sprintf(
/* translators: %s: IP address of password reset requester. */
__( 'This password reset request originated from the IP address %s.' ),
$requester_ip
) . "\r\n";
if ( ! is_user_logged_in() ) {
$requester_ip = $_SERVER['REMOTE_ADDR'];
if ( $requester_ip ) {
$message .= sprintf(
/* translators: %s: IP address of password reset requester. */
__( 'This password reset request originated from the IP address %s.' ),
$requester_ip
) . "\r\n";
}
}
/* translators: Password reset notification email subject. %s: Site title. */

2
wp-includes/version.php
View File

@ -13,7 +13,7 @@
*
* @global string $wp_version
*/
$wp_version = '5.7-beta3-50421';
$wp_version = '5.7-beta3-50422';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.