Ticket #24617: 24617.03.patch

src/wp-includes/user.php

@@ -2036 +2036 @@
          */
         do_action( 'retrieve_password', $user->user_login );
 
+        $allow = true;
+        if ( is_multisite() && is_user_spammy( $user ) ) {
+                $allow = new WP_Error( 'marked_as_spam', __( 'Your account has been marked as spam.' ) );
+        }
+
         /**
          * Filter whether to allow a password to be reset.
          *
          * @since 2.7.0
          *
-         * @param bool $allow         Whether to allow the password to be reset. Default true.
-         * @param int  $user_data->ID The ID of the user attempting to reset a password.
+         * @param bool    $allow    Whether to allow the password to be reset. Default true.
+         * @param int     $user->ID The ID of the user attempting to reset a password.
+         * @param WP_User $user     The WP_User object of the user attempting to reset a password.
          */
-        $allow = apply_filters( 'allow_password_reset', true, $user->ID );
+        $allow = apply_filters( 'allow_password_reset', $allow, $user->ID, $user );
 
         if ( ! $allow ) {
                 return new WP_Error( 'no_password_reset', __( 'Password reset is not allowed for this user' ) );