WordPress.org

Make WordPress Core

Ticket #5919: 5919.2.diff

File 5919.2.diff, 6.9 KB (added by scribu, 4 years ago)

input new password twice

  • wp-login.php

     
    115115                        echo '<p class="message">' . apply_filters('login_messages', $messages) . "</p>\n"; 
    116116        } 
    117117} // End of login_header() 
     118 
     119/** 
     120 * Outputs the footer for the login page. 
     121 * 
     122 * @param string $input_id Which input to auto-focus 
     123 */ 
     124function login_footer($input_id = '') { 
     125        echo "</div>\n"; 
     126 
     127        if ( !empty($input_id) ) { 
     128?> 
     129<script type="text/javascript"> 
     130try{document.getElementById('<?php echo $input_id; ?>').focus();}catch(e){} 
     131if(typeof wpOnload=='function')wpOnload(); 
     132</script> 
     133<?php 
     134        } 
     135?> 
     136<p id="backtoblog"><a href="<?php bloginfo('url'); ?>/" title="<?php _e('Are you lost?') ?>"><?php printf(__('&larr; Back to %s'), get_bloginfo('title', 'display' )); ?></a></p> 
     137 
     138</body> 
     139</html> 
     140<?php 
     141} 
     142 
    118143function wp_shake_js() { 
    119144        global $is_iphone; 
    120145        if ( $is_iphone ) 
     
    211236} 
    212237 
    213238/** 
    214  * Handles resetting the user's password. 
     239 * Retrieves a user row based on password reset key and login 
    215240 * 
    216241 * @uses $wpdb WordPress Database object 
    217242 * 
    218243 * @param string $key Hash to validate sending user's password 
    219  * @return bool|WP_Error 
     244 * @param string $login The user login 
     245 * 
     246 * @return object|WP_Error 
    220247 */ 
    221 function reset_password($key, $login) { 
     248function check_password_reset_key($key, $login) { 
    222249        global $wpdb; 
    223250 
    224251        $key = preg_replace('/[^a-z0-9]/i', '', $key); 
     
    230257                return new WP_Error('invalid_key', __('Invalid key')); 
    231258 
    232259        $user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_activation_key = %s AND user_login = %s", $key, $login)); 
     260 
    233261        if ( empty( $user ) ) 
    234262                return new WP_Error('invalid_key', __('Invalid key')); 
     263                 
     264        return $user; 
     265} 
    235266 
    236         // Generate something random for a password... 
    237         $new_pass = wp_generate_password(); 
    238  
     267/** 
     268 * Handles resetting the user's password. 
     269 * 
     270 * @uses $wpdb WordPress Database object 
     271 * 
     272 * @param string $key Hash to validate sending user's password 
     273 */ 
     274function reset_password($user, $new_pass) { 
    239275        do_action('password_reset', $user, $new_pass); 
    240276 
    241277        wp_set_password($new_pass, $user->ID); 
    242         update_user_option($user->ID, 'default_password_nag', true, true); //Set up the Password change nag. 
    243         $message  = sprintf(__('Username: %s'), $user->user_login) . "\r\n"; 
    244         $message .= sprintf(__('Password: %s'), $new_pass) . "\r\n"; 
    245         $message .= site_url('wp-login.php', 'login') . "\r\n"; 
    246278 
    247         if ( is_multisite() ) 
    248                 $blogname = $GLOBALS['current_site']->site_name; 
    249         else 
    250                 // The blogname option is escaped with esc_html on the way into the database in sanitize_option 
    251                 // we want to reverse this for the plain text arena of emails. 
    252                 $blogname = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES); 
    253  
    254         $title = sprintf( __('[%s] Your new password'), $blogname ); 
    255  
    256         $title = apply_filters('password_reset_title', $title); 
    257         $message = apply_filters('password_reset_message', $message, $new_pass); 
    258  
    259         if ( $message && !wp_mail($user->user_email, $title, $message) ) 
    260                 wp_die( __('The e-mail could not be sent.') . "<br />\n" . __('Possible reason: your host may have disabled the mail() function...') ); 
    261  
    262279        wp_password_change_notification($user); 
    263  
    264         return true; 
    265280} 
    266281 
    267282/** 
     
    398413</form> 
    399414 
    400415<p id="nav"> 
     416<a href="<?php echo site_url('wp-login.php', 'login') ?>"><?php _e('Log in') ?></a> 
    401417<?php if (get_option('users_can_register')) : ?> 
    402 <a href="<?php echo site_url('wp-login.php', 'login') ?>"><?php _e('Log in') ?></a> | 
    403 <a href="<?php echo site_url('wp-login.php?action=register', 'login') ?>"><?php _e('Register') ?></a> 
    404 <?php else : ?> 
    405 <a href="<?php echo site_url('wp-login.php', 'login') ?>"><?php _e('Log in') ?></a> 
     418 | <a href="<?php echo site_url('wp-login.php?action=register', 'login') ?>"><?php _e('Register') ?></a> 
    406419<?php endif; ?> 
    407420</p> 
    408421 
    409 </div> 
    410  
    411 <p id="backtoblog"><a href="<?php bloginfo('url'); ?>/" title="<?php _e('Are you lost?') ?>"><?php printf(__('&larr; Back to %s'), get_bloginfo('title', 'display' )); ?></a></p> 
    412  
    413 <script type="text/javascript"> 
    414 try{document.getElementById('user_login').focus();}catch(e){} 
    415 if(typeof wpOnload=='function')wpOnload(); 
    416 </script> 
    417 </body> 
    418 </html> 
    419422<?php 
     423login_footer('user_login'); 
    420424break; 
    421425 
    422426case 'resetpass' : 
    423427case 'rp' : 
    424         $errors = reset_password($_GET['key'], $_GET['login']); 
     428        $user = check_password_reset_key($_GET['key'], $_GET['login']); 
    425429 
    426         if ( ! is_wp_error($errors) ) { 
    427                 wp_redirect('wp-login.php?checkemail=newpass'); 
    428                 exit(); 
     430        if ( is_wp_error($user) ) { 
     431                wp_redirect('wp-login.php?action=lostpassword&error=invalidkey'); 
     432                exit; 
    429433        } 
    430434 
    431         wp_redirect('wp-login.php?action=lostpassword&error=invalidkey'); 
    432         exit(); 
     435        $errors = ''; 
    433436 
     437        if ( isset($_POST['pass1']) && $_POST['pass1'] != $_POST['pass2'] ) { 
     438                $errors = new WP_Error('password_reset_mismatch', __('The passwords do not match.')); 
     439        } 
     440        elseif ( isset($_POST['pass1']) && !empty($_POST['pass1']) ) { 
     441                reset_password($user, $_POST['pass']); 
     442                login_header(__('Password Reset'), '<p class="message reset-pass">' . __('Your password has been reset.') . ' <a href="' . site_url('wp-login.php', 'login') . '">' . __('Log in') . '</a></p>'); 
     443                login_footer(); 
     444                exit; 
     445        } 
     446 
     447        login_header(__('Reset Password'), '<p class="message reset-pass">' . __('Reset your password') . '</p>', $errors ); 
     448?> 
     449<form name="resetpassform" id="resetpassform" action="<?php echo site_url('wp-login.php?action=resetpass&key=' . urlencode($_GET['key']) . '&login=' . urlencode($_GET['login']), 'login_post') ?>" method="post"> 
     450        <p> 
     451                <label><?php _e('New Password') ?><br /> 
     452                <input type="password" name="pass1" id="user_pass" size="16" value="" autocomplete="off" /></label> 
     453        </p> 
     454        <p> 
     455                <label><?php _e('New Password Again') ?><br /> 
     456                <input type="password" name="pass2" id="user_pass" size="16" value="" autocomplete="off" /></label> 
     457        </p> 
     458        <br class="clear" /> 
     459        <p class="submit"><input type="submit" name="wp-submit" id="wp-submit" class="button-primary" value="<?php esc_attr_e('Reset Password'); ?>" tabindex="100" /></p> 
     460</form> 
     461 
     462<p id="nav"> 
     463<a href="<?php echo site_url('wp-login.php', 'login') ?>"><?php _e('Log in') ?></a> 
     464<?php if (get_option('users_can_register')) : ?> 
     465 | <a href="<?php echo site_url('wp-login.php?action=register', 'login') ?>"><?php _e('Register') ?></a> 
     466<?php endif; ?> 
     467</p> 
     468 
     469<?php 
     470login_footer('user_pass'); 
    434471break; 
    435472 
    436473case 'register' : 
     
    485522<a href="<?php echo site_url('wp-login.php?action=lostpassword', 'login') ?>" title="<?php _e('Password Lost and Found') ?>"><?php _e('Lost your password?') ?></a> 
    486523</p> 
    487524 
    488 </div> 
    489  
    490 <p id="backtoblog"><a href="<?php bloginfo('url'); ?>/" title="<?php _e('Are you lost?') ?>"><?php printf(__('&larr; Back to %s'), get_bloginfo('title', 'display' )); ?></a></p> 
    491  
    492 <script type="text/javascript"> 
    493 try{document.getElementById('user_login').focus();}catch(e){} 
    494 if(typeof wpOnload=='function')wpOnload(); 
    495 </script> 
    496 </body> 
    497 </html> 
    498525<?php 
     526login_footer('user_login'); 
    499527break; 
    500528 
    501529case 'login' :