vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-10-04 14:47:02 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Privacy: update the method to confirm user requests by email. Use a single CPT to store the requests and to allow logging/audit trail.

Browse Source 
Props mikejolley.
See #43443.


git-svn-id: https://develop.svn.wordpress.org/trunk@43008 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Andrew Ozz
2018-04-27 10:12:01 +00:00
parent 0907ed4894
commit 11d594e3a8
7 changed files with 358 additions and 392 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/wp-login.php
+16 -25
View File
@@ -427,7 +427,7 @@ if ( isset( $_GET['key'] ) ) {
}
// validate action so as to default to the login screen
if ( ! in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'verifyaccount' ), true ) && false === has_filter( 'login_form_' . $action ) ) {
if ( ! in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'confirmaction' ), true ) && false === has_filter( 'login_form_' . $action ) ) {
$action = 'login';
}
@@ -858,26 +858,21 @@ switch ( $action ) {
break;
case 'verifyaccount' :
if ( isset( $_GET['confirm_action'], $_GET['confirm_key'], $_GET['uid'] ) ) {
$key = sanitize_text_field( wp_unslash( $_GET['confirm_key'] ) );
$uid = sanitize_text_field( wp_unslash( $_GET['uid'] ) );
$action_name = sanitize_key( wp_unslash( $_GET['confirm_action'] ) );
$result = wp_check_account_verification_key( $key, $uid, $action_name );
case 'confirmaction' :
if ( ! isset( $_GET['request_id'] ) ) {
wp_die( __( 'Invalid request' ) );
}
$request_id = (int) $_GET['request_id'];
if ( isset( $_GET['confirm_key'] ) ) {
$key = sanitize_text_field( wp_unslash( $_GET['confirm_key'] ) );
$result = wp_validate_user_request_key( $request_id, $key );
} else {
$result = new WP_Error( 'invalid_key', __( 'Invalid key' ) );
}
if ( is_wp_error( $result ) ) {
/**
* Fires an action hook when the account action was not confirmed.
*
* After running this action hook the page will die.
*
* @param WP_Error $result Error object.
*/
do_action( 'account_action_failed', $result );
wp_die( $result );
}
@@ -890,17 +885,13 @@ switch ( $action ) {
* After firing this action hook the page will redirect to wp-login a callback
* redirects or exits first.
*
* @param array $result {
* Data about the action which was confirmed.
*
* @type string $action Name of the action that was confirmed.
* @type string $email Email of the user who confirmed the action.
* }
* @param int $request_id Request ID.
*/
do_action( 'account_action_confirmed', $result );
do_action( 'user_request_action_confirmed', $request_id );
$message = '<p class="message">' . __( 'Action has been confirmed.' ) . '</p>';
login_header( '', $message );
$message = apply_filters( 'user_request_action_confirmed_message', '<p class="message">' . __( 'Action has been confirmed.' ) . '</p>', $request_id );
login_header( __( 'User action confirmed.' ), $message );
login_footer();
exit;