Ticket #33209: 33209.2.diff

wp-includes/ms-functions.php

@@ -1446 +1446 @@
 You can log in to the administrator account with the following information:
 
 Username: USERNAME
-Password: PASSWORD
-Log in here: BLOG_URLwp-login.php
 
+To set your password, visit the following address:
+<RESETPWLINK>
+
+After you have set your password, you can log in here: 
+BLOG_URLwp-login.php
+
 We hope you enjoy your new site. Thanks!
 
 --The Team @ SITE_NAME' );
@@ -1461 +1465 @@
         $welcome_email = str_replace( 'BLOG_TITLE', $title, $welcome_email );
         $welcome_email = str_replace( 'BLOG_URL', $url, $welcome_email );
         $welcome_email = str_replace( 'USERNAME', $user->user_login, $welcome_email );
-        $welcome_email = str_replace( 'PASSWORD', $password, $welcome_email );
+        
+        if ( false !== strpos( $welcome_email, 'PASSWORD' ) ) { // Email password to user
+                $welcome_email = str_replace( 'PASSWORD', $password, $welcome_email );
+        } else { // Don't email the password; send a password reset link instead
+        
+                // Generate something random for a password reset key.
+                $key = wp_generate_password( 20, false );
 
+                /** This action is documented in wp-login.php */
+                do_action( 'retrieve_password_key', $user->user_login, $key );
+
+                // Now insert the key, hashed, into the DB.
+                if ( empty( $wp_hasher ) ) {
+                        require_once ABSPATH . WPINC . '/class-phpass.php';
+                        $wp_hasher = new PasswordHash( 8, true );
+                }
+                $hashed = time() . ':' . $wp_hasher->HashPassword( $key );
+                $wpdb->update( $wpdb->users, array( 'user_activation_key' => $hashed ), array( 'user_login' => $user->user_login ) );
+
+                $resetpwlink = get_site_url( $blog_id, "wp-login.php?action=rp&key=$key&login=" . rawurlencode($user->user_login), 'login' );
+                $welcome_email = str_replace( 'RESETPWLINK', $resetpwlink, $welcome_email );
+        }
+        
+
         /**
          * Filter the content of the welcome email after site activation.
          *
@@ -1553 +1579 @@
         $welcome_email = apply_filters( 'update_welcome_user_email', $welcome_email, $user_id, $password, $meta );
         $welcome_email = str_replace( 'SITE_NAME', $current_site->site_name, $welcome_email );
         $welcome_email = str_replace( 'USERNAME', $user->user_login, $welcome_email );
-        $welcome_email = str_replace( 'PASSWORD', $password, $welcome_email );
         $welcome_email = str_replace( 'LOGINLINK', wp_login_url(), $welcome_email );
+        
+        if ( false !== strpos( $welcome_email, 'PASSWORD' ) ) { // Email password to user
+                $welcome_email = str_replace( 'PASSWORD', $password, $welcome_email );
+        } else { // Don't email the password; send a password reset link instead
+        
+                // Generate something random for a password reset key.
+                $key = wp_generate_password( 20, false );
 
+                /** This action is documented in wp-login.php */
+                do_action( 'retrieve_password_key', $user->user_login, $key );
+
+                // Now insert the key, hashed, into the DB.
+                if ( empty( $wp_hasher ) ) {
+                        require_once ABSPATH . WPINC . '/class-phpass.php';
+                        $wp_hasher = new PasswordHash( 8, true );
+                }
+                $hashed = time() . ':' . $wp_hasher->HashPassword( $key );
+                $wpdb->update( $wpdb->users, array( 'user_activation_key' => $hashed ), array( 'user_login' => $user->user_login ) );
+
+                $resetpwlink = network_site_url( "wp-login.php?action=rp&key=$key&login=" . rawurlencode($user->user_login), 'login' );
+                $welcome_email = str_replace( 'RESETPWLINK', $resetpwlink, $welcome_email );
+        }
+
         $admin_email = get_site_option( 'admin_email' );
 
         if ( $admin_email == '' )
@@ -2121 +2168 @@
 
 You can log in with the following information:
 Username: USERNAME
-Password: PASSWORD
+
+To set your password, visit the following address:
+<RESETPWLINK>
+
+After you have set your password, you can log in here: 
 LOGINLINK
 
 Thanks!