Ticket #44901: 44901.5.diff

src/wp-includes/user.php

@@ -2313 +2313 @@
         $key = preg_replace( '/[^a-z0-9]/i', '', $key );
 
         if ( empty( $key ) || ! is_string( $key ) ) {
-                return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
+                return new WP_Error( 'invalid_key', __( 'Invalid key.' ) );
         }
 
         if ( empty( $login ) || ! is_string( $login ) ) {
-                return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
+                return new WP_Error( 'invalid_key', __( 'Invalid key.' ) );
         }
 
         $row = $wpdb->get_row( $wpdb->prepare( "SELECT ID, user_activation_key FROM $wpdb->users WHERE user_login = %s", $login ) );
         if ( ! $row ) {
-                return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
+                return new WP_Error( 'invalid_key', __( 'Invalid key.' ) );
         }
 
         if ( empty( $wp_hasher ) ) {
@@ -2348 +2348 @@
         }
 
         if ( ! $pass_key ) {
-                return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
+                return new WP_Error( 'invalid_key', __( 'Invalid key.' ) );
         }
 
         $hash_is_correct = $wp_hasher->CheckPassword( $key, $pass_key );
@@ -2357 +2357 @@
                 return get_userdata( $row->ID );
         } elseif ( $hash_is_correct && $expiration_time ) {
                 // Key has an expiration time that's passed
-                return new WP_Error( 'expired_key', __( 'Invalid key' ) );
+                return new WP_Error( 'expired_key', __( 'Invalid key.' ) );
         }
 
         if ( hash_equals( $row->user_activation_key, $key ) || ( $hash_is_correct && ! $expiration_time ) ) {
-                $return  = new WP_Error( 'expired_key', __( 'Invalid key' ) );
+                $return  = new WP_Error( 'expired_key', __( 'Invalid key.' ) );
                 $user_id = $row->ID;
 
                 /**
@@ -2378 +2378 @@
                 return apply_filters( 'password_reset_key_expired', $return, $user_id );
         }
 
-        return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
+        return new WP_Error( 'invalid_key', __( 'Invalid key.' ) );
 }
 
 /**
@@ -3574 +3574 @@
         }
 
         if ( empty( $key ) ) {
-                return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
+                return new WP_Error( 'missing_key', __( 'Missing confirm key.' ) );
         }
 
         if ( empty( $wp_hasher ) ) {
@@ -3586 +3586 @@
         $saved_key        = $request->confirm_key;
 
         if ( ! $saved_key ) {
-                return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
+                return new WP_Error( 'invalid_key', __( 'Invalid key.' ) );
         }
 
         if ( ! $key_request_time ) {
-                return new WP_Error( 'invalid_key', __( 'Invalid action' ) );
+                return new WP_Error( 'invalid_key', __( 'Invalid action.' ) );
         }
 
         /**
@@ -3604 +3604 @@
         $expiration_time     = $key_request_time + $expiration_duration;
 
         if ( ! $wp_hasher->CheckPassword( $key, $saved_key ) ) {
-                return new WP_Error( 'invalid_key', __( 'Invalid key' ) );
+                return new WP_Error( 'invalid_key', __( 'Invalid key.' ) );
         }
 
         if ( ! $expiration_time || time() > $expiration_time ) {

src/wp-login.php

@@ -852 +852 @@
 
         case 'confirmaction':
                 if ( ! isset( $_GET['request_id'] ) ) {
-                        wp_die( __( 'Invalid request.' ) );
+                        wp_die( __( 'Missing request ID.' ) );
                 }
 
+                if ( ! isset( $_GET['confirm_key'] ) ) {
+                        wp_die( __( 'Missing confirm key.' ) );
+                }
+
                 $request_id = (int) $_GET['request_id'];
+                $key            = sanitize_text_field( wp_unslash( $_GET['confirm_key'] ) );
+                $result         = wp_validate_user_request_key( $request_id, $key );
 
-                if ( isset( $_GET['confirm_key'] ) ) {
-                        $key    = sanitize_text_field( wp_unslash( $_GET['confirm_key'] ) );
-                        $result = wp_validate_user_request_key( $request_id, $key );
-                } else {
-                        $result = new WP_Error( 'invalid_key', __( 'Invalid key' ) );
-                }
-
                 if ( is_wp_error( $result ) ) {
                         wp_die( $result );
                 }