Ticket #24617: 24617.01.patch

wp-login.php

@@ -212 +212 @@
                 $user_data = get_user_by('login', $login);
         }
 
+        // check if user is a spammer
+        if ( is_multisite() && $user_data->spam ) {
+                $errors->add( 'spammer_account', __( '<strong>ERROR</strong>: Your account has been marked as a spammer.' ) );
+        }
+
         do_action('lostpassword_post');
 
         if ( $errors->get_error_code() )
@@ -229 +234 @@
         do_action('retreive_password', $user_login);  // Misspelled and deprecated
         do_action('retrieve_password', $user_login);
 
-        $allow = apply_filters('allow_password_reset', true, $user_data->ID);
+        $allow = apply_filters( 'allow_password_reset', true, $user_data->ID, $user_data );
 
         if ( ! $allow )
                 return new WP_Error('no_password_reset', __('Password reset is not allowed for this user'));