Ticket #43443: update.43443.2.diff

wp-includes/user.php

@@ -2815 +2815 @@
  *
  * @since 5.0.0
  *
- * @param string $action_name        Name of the action that is being confirmed.
- * @param string $action_description User facing description of the action they will be confirming.
- * @param string $email              User email address. This can be the address of a registered or non-registered user. Defaults to logged in user email address.
- *
- * @return WP_ERROR|bool Will return true/false based on the success of sending the email, or a WP_Error object.
+ * @param string $email              User email address. This can be the address of a registered or non-registered user. Defaults to logged in user email address. 
+ * @param string $action_name        Name of the action that is being confirmed. Defaults to 'confirm_email'.
+ * @param string $action_description User facing description of the action they will be confirming. Defaults to "confirm your email address".
+ * @param array  $request_data       Misc data you want to send with the verification request and pass to the actions once the request is confirmed.
+ * @return WP_Error|bool Will return true/false based on the success of sending the email, or a WP_Error object.
  */
-function send_confirm_account_action_email( $action_name, $action_description = '', $email = '' ) {
+function wp_send_account_verification_key( $email = '', $action_name = '', $action_description = '', $request_data = array() ) {
+        if ( ! function_exists( 'wp_get_current_user' ) ) {
+                return new WP_Error( 'invalid', __( 'This function cannot be used before init.' ) );
+        }
+
         $action_name        = sanitize_key( $action_name );
         $action_description = wp_kses_post( $action_description );
 
         if ( empty( $action_name ) ) {
-                return new WP_Error( 'invalid_action', __( 'Invalid action' ) );
+                $action_name = 'confirm_email';
+        }
+
+        if ( empty( $action_description ) ) {
+                $action_description = __( 'Confirm your email address.' );
         }
 
         if ( empty( $email ) ) {
@@ -2846 +2854 @@
                 $user = get_user_by( 'email', $email );
         }
 
-        // We could be dealing with a registered user account, or a visitor.
-        $is_registered_user = $user && ! is_wp_error( $user );
-        $uid                = $is_registered_user ? $user->ID : hash( 'sha256', $email );
-        $confirm_key        = get_confirm_account_action_key( $action_name, $email );
+        $confirm_key = wp_get_account_verification_key( $email, $action_name, $request_data );
 
         if ( is_wp_error( $confirm_key ) ) {
                 return $confirm_key;
         }
 
-        // Prepare the email content.
-        if ( ! $action_description ) {
-                $action_description = $action_name;
+        // We could be dealing with a registered user account, or a visitor.
+        $is_registered_user = $user && ! is_wp_error( $user );
+
+        if ( $is_registered_user ) {
+                $uid = $user->ID;
+        } else {
+                // Generate a UID for this email address so we don't send the actual email in the query string. Hash is not supported on all systems.
+                $uid = function_exists( 'hash' ) ? hash( 'sha256', $email ) : sha1( $email );
         }
 
         /* translators: Do not translate DESCRIPTION, CONFIRM_URL, EMAIL, SITENAME, SITEURL: those are placeholders. */
         $email_text = __(
                 'Howdy,
 
-An account linked to your email address has requested to perform
-the following action:
+A request has been made to perform the following action on your account:
 
      ###DESCRIPTION###
 
-To confirm this action, please click on the following link:
+To confirm this, please click on the following link:
 ###CONFIRM_URL###
 
 You can safely ignore and delete this email if you do not want to
@@ -2887 +2896 @@
                 'email'       => $email,
                 'description' => $action_description,
                 'confirm_url' => add_query_arg( array(
-                        'action'         => 'emailconfirm',
+                        'action'         => 'verifyaccount',
                         'confirm_action' => $action_name,
                         'uid'            => $uid,
                         'confirm_key'    => $confirm_key,
@@ -2907 +2916 @@
          * ###SITENAME###           The name of the site.
          * ###SITEURL###            The URL to the site.
          *
+         * @since 5.0.0
+         * 
          * @param string $email_text     Text in the email.
          * @param array  $email_data {
          *     Data relating to the account action email.
@@ -2919 +2930 @@
          *     @type string $siteurl     The site URL sending the mail.
          * }
          */
-        $content = apply_filters( 'confirm_account_action_email_content', $email_text, $email_data );
+        $content = apply_filters( 'account_verification_email_content', $email_text, $email_data );
 
         $content = str_replace( '###DESCRIPTION###', $email_data['description'], $content );
         $content = str_replace( '###CONFIRM_URL###', esc_url_raw( $email_data['confirm_url'] ), $content );
@@ -2928 +2939 @@
         $content = str_replace( '###SITEURL###', esc_url_raw( $email_data['siteurl'] ), $content );
 
         /* translators: %s Site name. */
-        return wp_mail( $email_data['email'], sprintf( __( '[%s] Confirm Account Action' ), wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES ) ), $content );
+        return wp_mail( $email_data['email'], sprintf( __( '[%s] Confirm Action' ), wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES ) ), $content );
 }
 
 /**
@@ -2936 +2947 @@
  *
  * @since 5.0.0
  *
- * @param string $action_name Name of the action this key is being generated for.
- * @param string $email       User email address. This can be the address of a registered or non-registered user.
- *
+ * @param string $email        User email address. This can be the address of a registered or non-registered user.
+ * @param string $action_name  Name of the action this key is being generated for.
+ * @param array  $request_data Misc data you want to send with the verification request and pass to the actions once the request is confirmed.
  * @return string|WP_Error Confirmation key on success. WP_Error on error.
  */
-function get_confirm_account_action_key( $action_name, $email ) {
+function wp_get_account_verification_key( $email, $action_name, $request_data = array() ) {
         global $wp_hasher;
 
         if ( ! is_email( $email ) ) {
@@ -2967 +2978 @@
         }
 
         $hashed_key = $wp_hasher->HashPassword( $key );
+        $value      = array(
+                'time'         => time(),
+                'hash'         => $hashed_key,
+                'email'        => $email,
+                'request_data' => $request_data,
+        );
 
         if ( $is_registered_user ) {
-                $key_saved = (bool) update_user_meta( $user->ID, '_account_action_' . $action_name, implode( ':', array( time(), $hashed_key ) ) );
+                $key_saved = (bool) update_user_meta( $user->ID, '_verify_' . $action_name, wp_json_encode( $value ) );
         } else {
-                $key_saved = (bool) update_site_option( '_account_action_' . hash( 'sha256', $email ) . '_' . $action_name, implode( ':', array( time(), $hashed_key, $email ) ) );
+                $uid       = function_exists( 'hash' ) ? hash( 'sha256', $email ) : sha1( $email );
+                $key_saved = (bool) update_site_option( '_verify_' . $action_name . '_' . $uid, wp_json_encode( $value ) );
         }
 
         if ( false === $key_saved ) {
-                return new WP_Error( 'no_confirm_account_action_key_update', __( 'Could not save confirm account action key to database.' ) );
+                return new WP_Error( 'no_account_verification_key_update', __( 'Could not save confirm account action key to database.' ) );
         }
 
         return $key;
@@ -2986 +3004 @@
  *
  * @since 5.0.0
  *
- * @param string $action_name Name of the action this key is being generated for.
  * @param string $key         Key to confirm.
  * @param string $uid         Email hash or user ID.
- *
+ * @param string $action_name Name of the action this key is being generated for.
  * @return array|WP_Error WP_Error on failure, action name and user email address on success.
  */
-function check_confirm_account_action_key( $action_name, $key, $uid ) {
+function wp_check_account_verification_key( $key, $uid, $action_name ) {
         global $wp_hasher;
 
-        if ( ! empty( $action_name ) && ! empty( $key ) && ! empty( $uid ) ) {
-                $user = false;
+        if ( empty( $action_name ) || empty( $key ) || empty( $uid ) ) {
+                return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
+        }
 
-                if ( is_numeric( $uid ) ) {
-                        $user = get_user_by( 'id', absint( $uid ) );
-                }
+        $user = false;
 
-                // We could be dealing with a registered user account, or a visitor.
-                $is_registered_user = $user && ! is_wp_error( $user );
-                $key_request_time = '';
-                $saved_key        = '';
-                $email            = '';
+        if ( is_numeric( $uid ) ) {
+                $user = get_user_by( 'id', absint( $uid ) );
+        }
 
-                if ( empty( $wp_hasher ) ) {
-                        require_once ABSPATH . WPINC . '/class-phpass.php';
-                        $wp_hasher = new PasswordHash( 8, true );
-                }
+        // We could be dealing with a registered user account, or a visitor.
+        $is_registered_user = ( $user && ! is_wp_error( $user ) );
+        $key_request_time   = '';
+        $saved_key          = '';
+        $email              = '';
 
-                // Get the saved key from the database.
-                if ( $is_registered_user ) {
-                        $confirm_action_data = get_user_meta( $user->ID, '_account_action_' . $action_name, true );
-                        $email               = $user->user_email;
+        if ( empty( $wp_hasher ) ) {
+                require_once ABSPATH . WPINC . '/class-phpass.php';
+                $wp_hasher = new PasswordHash( 8, true );
+        }
 
-                        if ( false !== strpos( $confirm_action_data, ':' ) ) {
-                                list( $key_request_time, $saved_key ) = explode( ':', $confirm_action_data, 2 );
-                        }
-                } else {
-                        $confirm_action_data = get_site_option( '_account_action_' . $uid . '_' . $action_name, '' );
+        // Get the saved key from the database.
+        if ( $is_registered_user ) {
+                $raw_data = get_user_meta( $user->ID, '_verify_' . $action_name, true );
+                $email               = $user->user_email;
 
-                        if ( false !== strpos( $confirm_action_data, ':' ) ) {
-                                list( $key_request_time, $saved_key, $email ) = explode( ':', $confirm_action_data, 3 );
-                        }
+                if ( false !== strpos( $confirm_action_data, ':' ) ) {
+                        list( $key_request_time, $saved_key ) = explode( ':', $confirm_action_data, 2 );
                 }
+        } else {
+                $raw_data = get_site_option( '_verify_' . $action_name . '_' . $uid, '' );
 
-                if ( ! $saved_key ) {
-                        return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
+                if ( false !== strpos( $confirm_action_data, ':' ) ) {
+                        list( $key_request_time, $saved_key, $email ) = explode( ':', $confirm_action_data, 3 );
                 }
+        }
 
-                /**
-                 * Filters the expiration time of confirm keys.
-                 *
-                 * @param int $expiration The expiration time in seconds.
-                 */
-                $expiration_duration = apply_filters( 'account_action_expiration', DAY_IN_SECONDS );
-                $expiration_time     = $key_request_time + $expiration_duration;
-
-                if ( $wp_hasher->CheckPassword( $key, $saved_key ) ) {
-                        if ( $expiration_time && time() < $expiration_time ) {
-                                $return = array(
-                                        'action' => $action_name,
-                                        'email'  => $email,
-                                );
-                        } else {
-                                $return = new WP_Error( 'expired_key', __( 'The confirmation email has expired.' ) );
-                        }
+        $data             = json_decode( $raw_data, true );
+        $key_request_time = (int) isset( $data['time'] ) ? $data['time'] : 0;
+        $saved_key        = isset( $data['hash'] ) ? $data['hash'] : '';
+        $email            = sanitize_email( isset( $data['email'] ) ? $data['email'] : '' );
+        $request_data     = isset( $data['request_data'] ) ? $data['request_data'] : array();
 
-                        // Clean up stored keys.
-                        if ( $is_registered_user ) {
-                                delete_user_meta( $user->ID, '_account_action_' . $action_name );
-                        } else {
-                                delete_site_option( '_account_action_' . $uid . '_' . $action_name );
-                        }
+        if ( ! $saved_key ) {
+                return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
+        }
 
-                        return $return;
-                }
+        if ( ! $key_request_time || ! $email ) {
+                return new WP_Error( 'invalid_key', __( 'Invalid action' ) );
         }
 
-        return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
-}
+        /**
+         * Filters the expiration time of confirm keys.
+         *
+         * @since 5.0.0
+         * 
+         * @param int $expiration The expiration time in seconds.
+         */
+        $expiration_duration = apply_filters( 'account_verification_expiration', DAY_IN_SECONDS );
+        $expiration_time     = $key_request_time + $expiration_duration;
+
+        if ( ! $wp_hasher->CheckPassword( $key, $saved_key ) ) {
+                return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
+        }
+
+        if ( $expiration_time && time() < $expiration_time ) {
+                $return = array(
+                        'action'       => $action_name,
+                        'email'        => $email,
+                        'request_data' => $request_data,
+                );
+        } else {
+                $return = new WP_Error( 'expired_key', __( 'The confirmation email has expired.' ) );
+        }
+
+        // Clean up stored keys.
+        if ( $is_registered_user ) {
+                delete_user_meta( $user->ID, '_verify_' . $action_name );
+        } else {
+                delete_site_option( '_verify_' . $action_name . '_' . $uid );
+        }
+
+        return $return;
+}
+ No newline at end of file

wp-login.php

@@ -427 +427 @@
 }
 
 // validate action so as to default to the login screen
-if ( ! in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'emailconfirm' ), true ) && false === has_filter( 'login_form_' . $action ) ) {
+if ( ! in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'verifyaccount' ), true ) && false === has_filter( 'login_form_' . $action ) ) {
         $action = 'login';
 }
 
@@ -858 +858 @@
 
                 break;
 
-        case 'emailconfirm' :
+        case 'verifyaccount' :
                 if ( isset( $_GET['confirm_action'], $_GET['confirm_key'], $_GET['uid'] ) ) {
-                        $action_name = sanitize_key( wp_unslash( $_GET['confirm_action'] ) );
                         $key         = sanitize_text_field( wp_unslash( $_GET['confirm_key'] ) );
                         $uid         = sanitize_text_field( wp_unslash( $_GET['uid'] ) );
-                        $result      = check_confirm_account_action_key( $action_name, $key, $uid );
+                        $action_name = sanitize_key( wp_unslash( $_GET['confirm_action'] ) );
+                        $result      = wp_check_account_verification_key( $key, $uid, $action_name );
                 } else {
                         $result = new WP_Error( 'invalid_key', __( 'Invalid key' ) );
                 }
@@ -874 +874 @@
                          * 
                          * After running this action hook the page will die.
                          * 
+                         * @since 5.0.0
+                         * 
                          * @param WP_Error $result Error object.
                          */
                         do_action( 'account_action_failed', $result );
@@ -887 +889 @@
                  * Using this you can assume the user has agreed to perform the action by
                  * clicking on the link in the confirmation email.
                  * 
-                 * After firing this action hook the page will redirect to wp-login a callback 
+                 * After firing this action hook the page will redirect to wp-login a callback
                  * redirects or exits first.
                  * 
+                 * @since 5.0.0
+                 * 
                  * @param array $result {
                  *     Data about the action which was confirmed.
                  *