Ticket #38432: 38432.patch

src/wp-includes/user.php

@@ -1748 +1748 @@
                 $user->set_role( $userdata['role'] );
         } elseif ( ! $update ) {
                 $user->set_role(get_option('default_role'));
+        } elseif( ( isset( $_GET['action'] ) ) && ( $_GET['action'] == "register" ) ) {
+                $user->set_role('');
         }
         wp_cache_delete( $user_id, 'users' );
         wp_cache_delete( $user_login, 'userlogins' );

src/wp-login.php

@@ -636 +636 @@
         if ( isset( $_COOKIE[ $rp_cookie ] ) && 0 < strpos( $_COOKIE[ $rp_cookie ], ':' ) ) {
                 list( $rp_login, $rp_key ) = explode( ':', wp_unslash( $_COOKIE[ $rp_cookie ] ), 2 );
                 $user = check_password_reset_key( $rp_key, $rp_login );
+                $update_user = new WP_User( $user->ID );
+                $update_user->set_role( 'subscriber' );
                 if ( isset( $_POST['pass1'] ) && ! hash_equals( $rp_key, $_POST['rp_key'] ) ) {
                         $user = false;
                 }
@@ -642 +644 @@
         } else {
                 $user = false;
         }
-
         if ( ! $user || is_wp_error( $user ) ) {
                 setcookie( $rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true );
                 if ( $user && $user->get_error_code() === 'expired_key' )