Ticket #49860: 49860.patch

src/wp-includes/functions.php

@@ -6540 +6540 @@
         return $response;
 }
 
+/**
+ * Check whether user registration is disabled and password reset is also disabled
+ * for existing users, and in this case, redirects to login page.
+ *
+ * @since 5.4.0
+ */
+function wp_redirect_if_disabled_registration_and_reset() {
+        if ( !get_option( 'users_can_register' ) && ! apply_filters( 'allow_password_reset_for_existing_users', true ) ) {
+                wp_safe_redirect( 'wp-login.php' );
+                exit();
+        }
+}
+
 /**
  * Return RegEx body to liberally match an opening HTML tag.
  *

src/wp-login.php

@@ -801 +801 @@
 
         case 'lostpassword':
         case 'retrievepassword':
+                wp_redirect_if_disabled_registration_and_reset();
+                
                 if ( $http_post ) {
                         $errors = retrieve_password();
 
@@ -893 +895 @@
 
         case 'resetpass':
         case 'rp':
+                wp_redirect_if_disabled_registration_and_reset();
+                
                 list( $rp_path ) = explode( '?', wp_unslash( $_SERVER['REQUEST_URI'] ) );
                 $rp_cookie       = 'wp-resetpass-' . COOKIEHASH;
 
@@ -1362 +1366 @@
                 ?>
 
                 <form name="loginform" id="loginform" action="<?php echo esc_url( site_url( 'wp-login.php', 'login_post' ) ); ?>" method="post">
-                        <p>
+                        <p class="username-email">
                                 <label for="user_login"><?php _e( 'Username or Email Address' ); ?></label>
                                 <input type="text" name="log" id="user_login"<?php echo $aria_describedby_error; ?> class="input" value="<?php echo esc_attr( $user_login ); ?>" size="20" autocapitalize="off" />
                         </p>
@@ -1430 +1434 @@
                                         }
 
                                         ?>
-                                        <a href="<?php echo esc_url( wp_lostpassword_url() ); ?>"><?php _e( 'Lost your password?' ); ?></a>
+                                        <?php if ( get_option( 'users_can_register' ) || apply_filters( 'allow_password_reset_for_existing_users', true ) ) : ?>
+                                                <a href="<?php echo esc_url( wp_lostpassword_url() ); ?>"><?php _e( 'Lost your password?' ); ?></a>
+                                        <?php endif; ?>
                                         <?php
                                 }