Ticket #44940: 44940-breaking.diff

src/wp-includes/class-wp-user-request.php

@@ -116 +116 @@
                 $this->confirmed_timestamp = (int) get_post_meta( $post->ID, '_wp_user_request_confirmed_timestamp', true );
                 $this->completed_timestamp = (int) get_post_meta( $post->ID, '_wp_user_request_completed_timestamp', true );
                 $this->request_data        = json_decode( $post->post_content, true );
-                $this->confirm_key         = $post->post_password;
+
+                // See: https://core.trac.wordpress.org/ticket/44940
+                if ( ! empty( $post->post_password ) ) {
+                        $this->confirm_key = $post->post_password;
+                } else {
+                        // Backwards compatibility for requests lacking a confirm key.
+                        $this->confirm_key = wp_generate_user_request_key( $post->ID );
+                }
         }
 }

src/wp-includes/user.php

@@ -4845 +4845 @@
                         array(
                                 'action'      => 'confirmaction',
                                 'request_id'  => $request_id,
-                                'confirm_key' => wp_generate_user_request_key( $request_id ),
+                                'confirm_key' => $request->confirm_key,
                         ),
                         wp_login_url()
                 ),
@@ -4968 +4968 @@
  * Returns a confirmation key for a user action and stores the hashed version for future comparison.
  *
  * @since 4.9.6
+ * @since 6.9.0 Request ID optional. See: https://core.trac.wordpress.org/ticket/44940
  *
- * @param int $request_id Request ID.
+ * @param int $request_id Optional. Request ID. Default 0.
  * @return string Confirmation key.
  */
-function wp_generate_user_request_key( $request_id ) {
+function wp_generate_user_request_key( $request_id = 0 ) {
         // Generate something random for a confirmation key.
         $key = wp_generate_password( 20, false );
 
-        // Save the key, hashed.
-        wp_update_post(
-                array(
-                        'ID'            => $request_id,
-                        'post_status'   => 'request-pending',
-                        'post_password' => wp_fast_hash( $key ),
-                )
-        );
+        // Maybe save the hashed key to the request, if ID passed.
+        if ( $request_id ) {
+                wp_update_post(
+                        array(
+                                'ID'            => $request_id,
+                                'post_status'   => 'request-pending',
+                                'post_password' => wp_fast_hash( $key ),
+                        )
+                );
+        }
 
         return $key;
 }