Ticket #58901: 58901.diff

src/wp-includes/user.php

@@ -110 +110 @@
         }
 
         wp_set_auth_cookie( $user->ID, $credentials['remember'], $secure_cookie );
+
+        // Flush `user_activation_key` after successful login.
+        global $wpdb;
+        $wpdb->update(
+                $wpdb->users,
+                array( 'user_activation_key' => '', ),
+                array( 'ID' => $user->ID ),
+                array( '%s' ),
+                array( '%d' )
+        );
+
+        $user->__set( 'user_activation_key', '' );
+
         /**
          * Fires after the user has successfully logged in.
          *

tests/phpunit/tests/auth.php

@@ -423 +423 @@
                 $this->assertInstanceOf( 'WP_Error', $check );
         }
 
+        /**
+         * Ensure that the user_activation_key is cleared after a successful login.
+         *
+         * @ticket 58901
+         */
+        public function test_user_activation_key_after_successful_login() {
+                global $wpdb;
+
+                $reset_key                    = get_password_reset_key( $this->user );
+                $user                         = wp_signon(
+                        array(
+                                'user_login'    => self::USER_LOGIN,
+                                'user_password' => self::USER_PASS,
+                        )
+                );
+                $activation_key_from_database = $wpdb->get_var(
+                        $wpdb->prepare( "SELECT user_activation_key FROM $wpdb->users WHERE ID = %d", $this->user->ID )
+                );
+
+                $this->assertNotWPError( $reset_key, 'The password reset key was not created.' );
+                $this->assertNotWPError( $user, 'The user was not authenticated.' );
+                $this->assertEmpty( $user->user_activation_key, 'The `user_activation_key` was not empty on the user object returned by `wp_signon` function.' );
+                $this->assertEmpty( $activation_key_from_database, 'The `user_activation_key` was not empty in the database.' );
+        }
+
         /**
          * Ensure users can log in using both their username and their email address.
          *