Ticket #34281: 34281.8.diff

src/js/_enqueues/admin/user-profile.js

@@ -142 +142 @@
                 });
         }
 
+        /**
+         * Handle the password reset button. Sets up an ajax callback to trigger sending
+         * a password reset email.
+         */
+        function bindPasswordRestLink() {
+                $( '#generate-reset-link' ).on( 'click', function() {
+                        var $this  = $(this),
+                                data = {
+                                        'user_id': userProfileL10n.user_id, // The user to send a reset to.
+                                        'nonce':   userProfileL10n.nonce    // Nonce to validate the action.
+                                };
+
+                                // Remove any previous error messages.
+                                $this.parent().find( '.notice-error' ).remove();
+
+                                // Send the reset request.
+                                var resetAction =  wp.ajax.post( 'send-password-reset', data );
+
+                                // Handle reset success.
+                                resetAction.done( function( response ) {
+                                        addInlineNotice( $this, true, response );
+                                } );
+
+                                // Handle reset failure.
+                                resetAction.fail( function( response ) {
+                                        addInlineNotice( $this, false, response );
+                                } );
+
+                });
+
+        }
+
+        /**
+         * Helper function to insert an inline notice of success or failure.
+         *
+         * @param {jQuery Object} $this   The button element: the message will be inserted
+         *                                above this button
+         * @param {bool}          success Whether the message is a success message.
+         * @param {string}        message The message to insert.
+         */
+        function addInlineNotice( $this, success, message ) {
+                var resultDiv = $( '<div />' );
+
+                // Set up the notice div.
+                resultDiv.addClass( 'notice inline' );
+
+                // Add a class indicating success or failure.
+                resultDiv.addClass( 'notice-' + ( success ? 'success' : 'error' ) );
+
+                // Add the message, wrapping in a p tag, with a fadein to highlight each message.
+                resultDiv.text( $( $.parseHTML( message ) ).text() ).wrapInner( '<p />');
+
+                // Disable the button when the callback has succeeded.
+                $this.prop( 'disabled', success );
+
+                // Remove any previous notices.
+                $this.siblings( '.notice' ).remove();
+
+                // Insert the notice.
+                $this.before( resultDiv );
+        }
+
         function bindPasswordForm() {
                 var $passwordWrapper,
                         $generateButton,
@@ -430 +492 @@
                 });
 
                 bindPasswordForm();
+                bindPasswordRestLink();
         });
 
         $( '#destroy-sessions' ).on( 'click', function( e ) {

src/wp-admin/admin-ajax.php

@@ -131 +131 @@
         'edit-theme-plugin-file',
         'wp-privacy-export-personal-data',
         'wp-privacy-erase-personal-data',
+        'send-password-reset',
 );
 
 // Deprecated

src/wp-admin/includes/ajax-actions.php

@@ -4833 +4833 @@
 
         wp_send_json_success( $response );
 }
+
+/**
+ * Ajax handler sends a password reset link.
+ *
+ * @since 4.4.0
+ */
+function wp_ajax_send_password_reset() {
+
+        // Validate the nonce for this action.
+        $user_id = isset( $_POST['user_id'] ) ? (int) $_POST['user_id'] : 0;
+        check_ajax_referer( 'reset-password-for-' . $user_id, 'nonce' );
+
+        // Verify user capabilities.
+        if ( ! current_user_can( 'edit_user', $user_id ) ) {
+                wp_send_json_error( __( 'Cannot send password reset, permission denied.' ) );
+        }
+
+        // Send the password reset link.
+        $user    = get_userdata( $user_id );
+        $results = retrieve_password( $user->user_login );
+
+        if ( true === $results ) {
+                wp_send_json_success(
+                        /* translators: 1: User's display name. */
+                        sprintf( __( 'A password reset link was emailed to %s.' ), $user->display_name )
+                );
+        } else {
+                wp_send_json_error( $results );
+        }
+}

src/wp-admin/includes/class-wp-users-list-table.php

@@ -250 +250 @@
                         }
                 }
 
+                // Add a password reset link to the bulk actions dropdown.
+                if ( current_user_can( 'edit_users' ) ) {
+                        $actions['resetpassword'] = __( 'Send password reset' );
+                }
+
+
                 return $actions;
         }
 
@@ -447 +453 @@
                                 );
                         }
 
+                        // Add a link to send the user a reset password link by email.
+                        if ( get_current_user_id() != $user_object->ID && current_user_can( 'edit_user', $user_object->ID ) )
+                                $actions['resetpassword'] = "<a class='resetpassword' href='" . wp_nonce_url( "users.php?action=resetpassword&amp;users=$user_object->ID", 'bulk-users' ) . "'>" . __( 'Send password reset' ) . "</a>";
+
+
                         /**
                          * Filters the action links displayed under each user in the Users list table.
                          *

src/wp-admin/user-edit.php

@@ -589 +589 @@
                 </p>
         </td>
 </tr>
+<?php endif; ?>
+<?php
+// Allow admins to send reset password link
+if ( ! IS_PROFILE_PAGE ) :
+?>
+        <tr class="user-sessions-wrap hide-if-no-js">
+                <th><?php _e( 'Password Reset' ); ?></th>
+                <td>
+                        <div class="generate-reset-link">
+                                <button type="button" class="button button-secondary" id="generate-reset-link">
+                                        <?php _e( 'Send Reset Link' ); ?>
+                                </button>
+                        </div>
+                        <p class="description">
+                                <?php
+                                /* translators: 1: User's display name. */
+                                printf( __( 'Send %s a link to reset their password. This will not change their password, nor will it force a change.' ), esc_html( $profileuser->display_name ) );
+                                ?>
+                        </p>
+                </td>
+        </tr>
 <?php endif; ?>
 
                 <?php

src/wp-admin/users.php

@@ -212 +212 @@
                 wp_redirect( $redirect );
                 exit();
 
+        case 'resetpassword':
+                check_admin_referer('bulk-users');
+                if ( ! current_user_can( 'edit_users' ) ) {
+                        $errors = new WP_Error( 'edit_users', __( 'You can’t edit users.' ) );
+                }
+                if ( empty( $_REQUEST['users'] ) ) {
+                        wp_redirect( $redirect );
+                        exit();
+                }
+                $userids = array_map( 'intval', (array) $_REQUEST['users'] );
+
+                $reset_count = 0;
+
+                foreach ( $userids as $id ) {
+                        if ( ! current_user_can( 'edit_user', $id ) )
+                                wp_die(__( 'You can’t edit that user.' ) );
+
+                        if ( $id == $current_user->ID ) {
+                                $update = 'err_admin_reset';
+                                continue;
+                        }
+
+                        // Send the password reset link.
+                        $user = get_userdata( $id );
+                        if ( retrieve_password( $user->user_login ) ) {
+                                ++$reset_count;
+                        }
+
+                }
+
+                $redirect = add_query_arg(
+                        array(
+                                'reset_count' => $reset_count,
+                                'update' => 'resetpassword',
+                        ), $redirect
+                );
+                wp_redirect( $redirect );
+                exit();
+
         case 'delete':
                 if ( is_multisite() ) {
                         wp_die( __( 'User deletion is not allowed from this screen.' ), 400 );
@@ -487 +526 @@
                                                 $messages[] = '<div id="message" class="updated notice is-dismissible"><p>' . __( 'New user created.' ) . '</p></div>';
                                         }
                                         break;
+                                case 'resetpassword':
+                                        $reset_count = isset( $_GET['reset_count'] ) ? (int) $_GET['reset_count'] : 0;
+                                        if ( 1 === $reset_count ) {
+                                                $message = __( 'Password reset link sent.' );
+                                        } else {
+                                                $message = sprintf( __( 'Password reset links sent to %s users.' ), $reset_count );
+                                        }
+                                        $messages[] = '<div id="message" class="updated notice is-dismissible"><p>' . $message . '</p></div>';
+                                        break;
                                 case 'promote':
                                         $messages[] = '<div id="message" class="updated notice is-dismissible"><p>' . __( 'Changed roles.' ) . '</p></div>';
                                         break;

src/wp-includes/functions.php

@@ -6830 +6830 @@
         );
         echo'</p>';
 }
+
+
+/**
+ * Handles sending password retrieval email to user.
+ *
+ * @global wpdb         $wpdb       WordPress database abstraction object.
+ * @global PasswordHash $wp_hasher  Portable PHP password hashing framework.
+ * @param  string       $user_login Optional user_login, default null.
+ *                                  Uses $_POST['user_login'] if $user_login not set.
+ *
+ * @return bool|WP_Error True: when finish. WP_Error on error
+ */
+function retrieve_password( $user_login = null ) {
+        global $wpdb, $wp_hasher;
+
+        $errors = new WP_Error();
+
+        // Use the passed $user_login if available, otherwise use $_POST['user_login'].
+        if ( !$user_login && !empty( $_POST['user_login'] ) ) {
+                        $user_login = $_POST['user_login'];
+        }
+
+        if ( empty( $user_login ) ) {
+                        $errors->add('empty_username', __('<strong>ERROR</strong>: Enter a username or email address.'));
+        } elseif ( strpos( $user_login, '@' ) ) {
+                        $user_data = get_user_by( 'email', sanitize_email( $user_login ) );
+                if ( empty( $user_data ) )
+                        $errors->add('invalid_email', __('<strong>ERROR</strong>: There is no user registered with that email address.'));
+        } else {
+                        $user_data = get_user_by('login', sanitize_user( $user_login ) );
+        }
+
+        /**
+         * Fires before errors are returned from a password reset request.
+         *
+         * @since 2.1.0
+         * @since 4.4.0 Added the `$errors` parameter.
+         *
+         * @param WP_Error $errors A WP_Error object containing any errors generated
+         *                         by using invalid credentials.
+         */
+        do_action( 'lostpassword_post', $errors );
+
+        if ( $errors->get_error_code() )
+                return $errors;
+
+        if ( !$user_data ) {
+                $errors->add('invalidcombo', __('<strong>ERROR</strong>: Invalid username or email.'));
+                return $errors;
+        }
+
+        // Redefining user_login ensures we return the right case in the email.
+        $user_login = $user_data->user_login;
+        $user_email = $user_data->user_email;
+        $key = get_password_reset_key( $user_data );
+
+        if ( is_wp_error( $key ) ) {
+                        return $key;
+        }
+
+        $message = __('Someone requested that the password be reset for the following account:') . "\r\n\r\n";
+        $message .= network_home_url( '/' ) . "\r\n\r\n";
+        $message .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n";
+        $message .= __('If this was a mistake, just ignore this email and nothing will happen.') . "\r\n\r\n";
+        $message .= __('To reset your password, visit the following address:') . "\r\n\r\n";
+        $message .= '<' . network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . ">\r\n";
+
+        if ( is_multisite() )
+                $blogname = $GLOBALS['current_site']->site_name;
+        else
+                /*
+                 * The blogname option is escaped with esc_html on the way into the database
+                 * in sanitize_option we want to reverse this for the plain text arena of emails.
+                 */
+                $blogname = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES);
+
+        $title = sprintf( __('[%s] Password Reset'), $blogname );
+
+        /**
+         * Filter the subject of the password reset email.
+         *
+         * @since 2.8.0
+         * @since 4.4.0 Added the `$user_login` and `$user_data` parameters.
+         *
+         * @param string  $title      Default email title.
+         * @param string  $user_login The username for the user.
+         * @param WP_User $user_data  WP_User object.
+         */
+        $title = apply_filters( 'retrieve_password_title', $title, $user_login, $user_data );
+
+        /**
+         * Filter the message body of the password reset mail.
+         *
+         * @since 2.8.0
+         * @since 4.1.0 Added `$user_login` and `$user_data` parameters.
+         *
+         * @param string  $message    Default mail message.
+         * @param string  $key        The activation key.
+         * @param string  $user_login The username for the user.
+         * @param WP_User $user_data  WP_User object.
+         */
+        $message = apply_filters( 'retrieve_password_message', $message, $key, $user_login, $user_data );
+
+        if ( $message && !wp_mail( $user_email, wp_specialchars_decode( $title ), $message ) )
+                wp_die( __('The email could not be sent.') . "<br />\n" . __('Possible reason: your host may have disabled the mail() function.') );
+
+        return true;
+}

src/wp-includes/script-loader.php

@@ -1307 +1307 @@
                 )
         );
 
+        $user_id = isset( $_GET['user_id'] ) ? (int) $_GET['user_id'] : 0;
         $scripts->add( 'user-profile', "/wp-admin/js/user-profile$suffix.js", array( 'jquery', 'password-strength-meter', 'wp-util' ), false, 1 );
         did_action( 'init' ) && $scripts->localize(
                 'user-profile',
@@ -1319 +1320 @@
                         'cancel'   => __( 'Cancel' ),
                         'ariaShow' => esc_attr__( 'Show password' ),
                         'ariaHide' => esc_attr__( 'Hide password' ),
+                        'user_id'  => $user_id,
+                        'nonce'    => wp_create_nonce( 'reset-password-for-' . $user_id ),
                 )
         );