WordPress.org
Get WordPress

Make WordPress Core


Ignore:
File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/wp-login.php

    r17465 r15090  
    8080    }
    8181
    82     do_action( 'login_enqueue_scripts' );
    83     do_action( 'login_head' ); ?>
     82    do_action('login_head'); ?>
    8483</head>
    8584<body class="login">
    8685<?php   if ( !is_multisite() ) { ?>
    87 <div id="login"><h1><a href="<?php echo apply_filters('login_headerurl', 'http://wordpress.org/'); ?>" title="<?php echo apply_filters('login_headertitle', esc_attr__('Powered by WordPress')); ?>"><?php bloginfo('name'); ?></a></h1>
     86<div id="login"><h1><a href="<?php echo apply_filters('login_headerurl', 'http://wordpress.org/'); ?>" title="<?php echo apply_filters('login_headertitle', __('Powered by WordPress')); ?>"><?php bloginfo('name'); ?></a></h1>
    8887<?php   } else { ?>
    89 <div id="login"><h1><a href="<?php echo apply_filters('login_headerurl', network_home_url() ); ?>" title="<?php echo apply_filters('login_headertitle', esc_attr($current_site->site_name) ); ?>"><span class="hide"><?php bloginfo('name'); ?></span></a></h1>
     88<div id="login"><h1><a href="<?php echo apply_filters('login_headerurl', network_home_url() ); ?>" title="<?php echo apply_filters('login_headertitle', $current_site->site_name ); ?>"><span class="hide"><?php bloginfo('name'); ?></span></a></h1>
    9089<?php   }
    9190
    … …  
    117116    }
    118117} // End of login_header()
    119 
    120 /**
    121  * Outputs the footer for the login page.
    122  *
    123  * @param string $input_id Which input to auto-focus
    124  */
    125 function login_footer($input_id = '') {
    126     echo "</div>\n";
    127 
    128     if ( !empty($input_id) ) {
    129 ?>
    130 <script type="text/javascript">
    131 try{document.getElementById('<?php echo $input_id; ?>').focus();}catch(e){}
    132 if(typeof wpOnload=='function')wpOnload();
    133 </script>
    134 <?php
    135     }
    136 ?>
    137 <p id="backtoblog"><a href="<?php bloginfo('url'); ?>/" title="<?php esc_attr_e('Are you lost?') ?>"><?php printf(__('&larr; Back to %s'), get_bloginfo('title', 'display' )); ?></a></p>
    138 <?php do_action('login_footer'); ?>
    139 </body>
    140 </html>
    141 <?php
    142 }
    143 
    144118function wp_shake_js() {
    145119    global $is_iphone;
    … …  
    213187        $wpdb->update($wpdb->users, array('user_activation_key' => $key), array('user_login' => $user_login));
    214188    }
    215     $message = __('Someone requested that the password be reset for the following account:') . "\r\n\r\n";
     189    $message = __('Someone has asked to reset the password for the following site and username.') . "\r\n\r\n";
    216190    $message .= network_site_url() . "\r\n\r\n";
    217191    $message .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n";
    218     $message .= __('If this was a mistake, just ignore this email and nothing will happen.') . "\r\n\r\n";
    219     $message .= __('To reset your password, visit the following address:') . "\r\n\r\n";
    220     $message .= '<' . network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . ">\r\n";
     192    $message .= __('To reset your password visit the following address, otherwise just ignore this email and nothing will happen.') . "\r\n\r\n";
     193    $message .= network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . "\r\n";
    221194
    222195    if ( is_multisite() )
    … …  
    239212
    240213/**
    241  * Retrieves a user row based on password reset key and login
     214 * Handles resetting the user's password.
    242215 *
    243216 * @uses $wpdb WordPress Database object
    244217 *
    245218 * @param string $key Hash to validate sending user's password
    246  * @param string $login The user login
    247  *
    248  * @return object|WP_Error
     219 * @return bool|WP_Error
    249220 */
    250 function check_password_reset_key($key, $login) {
     221function reset_password($key, $login) {
    251222    global $wpdb;
    252223
    … …  
    260231
    261232    $user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_activation_key = %s AND user_login = %s", $key, $login));
    262 
    263233    if ( empty( $user ) )
    264234        return new WP_Error('invalid_key', __('Invalid key'));
    265235
    266     return $user;
    267 }
    268 
    269 /**
    270  * Handles resetting the user's password.
    271  *
    272  * @uses $wpdb WordPress Database object
    273  *
    274  * @param string $key Hash to validate sending user's password
    275  */
    276 function reset_password($user, $new_pass) {
     236    // Generate something random for a password...
     237    $new_pass = wp_generate_password();
     238
    277239    do_action('password_reset', $user, $new_pass);
    278240
    279241    wp_set_password($new_pass, $user->ID);
     242    update_user_option($user->ID, 'default_password_nag', true, true); //Set up the Password change nag.
     243    $message  = sprintf(__('Username: %s'), $user->user_login) . "\r\n";
     244    $message .= sprintf(__('Password: %s'), $new_pass) . "\r\n";
     245    $message .= site_url('wp-login.php', 'login') . "\r\n";
     246
     247    if ( is_multisite() )
     248        $blogname = $GLOBALS['current_site']->site_name;
     249    else
     250        // The blogname option is escaped with esc_html on the way into the database in sanitize_option
     251        // we want to reverse this for the plain text arena of emails.
     252        $blogname = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES);
     253
     254    $title = sprintf( __('[%s] Your new password'), $blogname );
     255
     256    $title = apply_filters('password_reset_title', $title);
     257    $message = apply_filters('password_reset_message', $message, $new_pass);
     258
     259    if ( $message && !wp_mail($user->user_email, $title, $message) )
     260        wp_die( __('The e-mail could not be sent.') . "<br />\n" . __('Possible reason: your host may have disabled the mail() function...') );
    280261
    281262    wp_password_change_notification($user);
     263
     264    return true;
    282265}
    283266
    … …  
    322305        return $errors;
    323306
    324     $user_pass = wp_generate_password( 12, false);
     307    $user_pass = wp_generate_password();
    325308    $user_id = wp_create_user( $sanitized_user_login, $user_pass, $user_email );
    326309    if ( ! $user_id ) {
    … …  
    386369case 'lostpassword' :
    387370case 'retrievepassword' :
    388 
    389371    if ( $http_post ) {
    390372        $errors = retrieve_password();
    … …  
    400382
    401383    do_action('lost_password');
    402     login_header(__('Lost Password'), '<p class="message">' . __('Please enter your username or email address. You will receive a link to create a new password via email.') . '</p>', $errors);
     384    login_header(__('Lost Password'), '<p class="message">' . __('Please enter your username or e-mail address. You will receive a new password via e-mail.') . '</p>', $errors);
    403385
    404386    $user_login = isset($_POST['user_login']) ? stripslashes($_POST['user_login']) : '';
    … …  
    417399
    418400<p id="nav">
     401<?php if (get_option('users_can_register')) : ?>
     402<a href="<?php echo site_url('wp-login.php', 'login') ?>"><?php _e('Log in') ?></a> |
     403<a href="<?php echo site_url('wp-login.php?action=register', 'login') ?>"><?php _e('Register') ?></a>
     404<?php else : ?>
    419405<a href="<?php echo site_url('wp-login.php', 'login') ?>"><?php _e('Log in') ?></a>
    420 <?php if (get_option('users_can_register')) : ?>
    421  | <a href="<?php echo site_url('wp-login.php?action=register', 'login') ?>"><?php _e('Register') ?></a>
    422406<?php endif; ?>
    423407</p>
    424408
    425 <?php
    426 login_footer('user_login');
     409</div>
     410
     411<p id="backtoblog"><a href="<?php bloginfo('url'); ?>/" title="<?php _e('Are you lost?') ?>"><?php printf(__('&larr; Back to %s'), get_bloginfo('title', 'display' )); ?></a></p>
     412
     413<script type="text/javascript">
     414try{document.getElementById('user_login').focus();}catch(e){}
     415if(typeof wpOnload=='function')wpOnload();
     416</script>
     417</body>
     418</html>
     419<?php
    427420break;
    428421
    429422case 'resetpass' :
    430423case 'rp' :
    431     $user = check_password_reset_key($_GET['key'], $_GET['login']);
    432 
    433     if ( is_wp_error($user) ) {
    434         wp_redirect( site_url('wp-login.php?action=lostpassword&error=invalidkey') );
    435         exit;
    436     }
    437 
    438     $errors = '';
    439 
    440     if ( isset($_POST['pass1']) && $_POST['pass1'] != $_POST['pass2'] ) {
    441         $errors = new WP_Error('password_reset_mismatch', __('The passwords do not match.'));
    442     } elseif ( isset($_POST['pass1']) && !empty($_POST['pass1']) ) {
    443         reset_password($user, $_POST['pass1']);
    444         login_header(__('Password Reset'), '<p class="message reset-pass">' . __('Your password has been reset.') . ' <a href="' . site_url('wp-login.php', 'login') . '">' . __('Log in') . '</a></p>');
    445         login_footer();
    446         exit;
    447     }
    448 
    449     wp_enqueue_script('utils');
    450     wp_enqueue_script('user-profile');
    451 
    452     login_header(__('Reset Password'), '<p class="message reset-pass">' . __('Enter your new password below.') . '</p>', $errors );
    453 
    454 ?>
    455 <form name="resetpassform" id="resetpassform" action="<?php echo site_url('wp-login.php?action=resetpass&key=' . urlencode($_GET['key']) . '&login=' . urlencode($_GET['login']), 'login_post') ?>" method="post">
    456     <input type="hidden" id="user_login" value="<?php echo esc_attr( $_GET['login'] ); ?>" autocomplete="off" />
    457 
    458     <p>
    459         <label><?php _e('New password') ?><br />
    460         <input type="password" name="pass1" id="pass1" class="input" size="20" value="" autocomplete="off" /></label>
    461     </p>
    462     <p>
    463         <label><?php _e('Confirm new password') ?><br />
    464         <input type="password" name="pass2" id="pass2" class="input" size="20" value="" autocomplete="off" /></label>
    465     </p>
    466 
    467     <div id="pass-strength-result" class="hide-if-no-js"><?php _e('Strength indicator'); ?></div>
    468     <p class="description indicator-hint"><?php _e('Hint: The password should be at least seven characters long. To make it stronger, use upper and lower case letters, numbers and symbols like ! " ? $ % ^ &amp; ).'); ?></p>
    469 
    470     <br class="clear" />
    471     <p class="submit"><input type="submit" name="wp-submit" id="wp-submit" class="button-primary" value="<?php esc_attr_e('Reset Password'); ?>" tabindex="100" /></p>
    472 </form>
    473 
    474 <p id="nav">
    475 <a href="<?php echo site_url('wp-login.php', 'login') ?>"><?php _e('Log in') ?></a>
    476 <?php if (get_option('users_can_register')) : ?>
    477  | <a href="<?php echo site_url('wp-login.php?action=register', 'login') ?>"><?php _e('Register') ?></a>
    478 <?php endif; ?>
    479 </p>
    480 
    481 <?php
    482 login_footer('user_pass');
     424    $errors = reset_password($_GET['key'], $_GET['login']);
     425
     426    if ( ! is_wp_error($errors) ) {
     427        wp_redirect('wp-login.php?checkemail=newpass');
     428        exit();
     429    }
     430
     431    wp_redirect('wp-login.php?action=lostpassword&error=invalidkey');
     432    exit();
     433
    483434break;
    484435
    … …  
    486437    if ( is_multisite() ) {
    487438        // Multisite uses wp-signup.php
    488         wp_redirect( apply_filters( 'wp_signup_location', site_url('wp-signup.php') ) );
     439        wp_redirect( apply_filters( 'wp_signup_location', get_bloginfo('wpurl') . '/wp-signup.php' ) );
    489440        exit;
    490441    }
    491442
    492443    if ( !get_option('users_can_register') ) {
    493         wp_redirect( site_url('wp-login.php?registration=disabled') );
     444        wp_redirect('wp-login.php?registration=disabled');
    494445        exit();
    495446    }
    … …  
    498449    $user_email = '';
    499450    if ( $http_post ) {
     451        require_once( ABSPATH . WPINC . '/registration.php');
     452
    500453        $user_login = $_POST['user_login'];
    501454        $user_email = $_POST['user_email'];
    … …  
    533486</p>
    534487
    535 <?php
    536 login_footer('user_login');
     488</div>
     489
     490<p id="backtoblog"><a href="<?php bloginfo('url'); ?>/" title="<?php _e('Are you lost?') ?>"><?php printf(__('&larr; Back to %s'), get_bloginfo('title', 'display' )); ?></a></p>
     491
     492<script type="text/javascript">
     493try{document.getElementById('user_login').focus();}catch(e){}
     494if(typeof wpOnload=='function')wpOnload();
     495</script>
     496</body>
     497</html>
     498<?php
    537499break;
    538500
    … …  
    584546<?php       exit;
    585547        }
    586 
    587         if ( ( empty( $redirect_to ) || $redirect_to == 'wp-admin/' || $redirect_to == admin_url() ) ) {
    588             // If the user doesn't belong to a blog, send them to user admin. If the user can't edit posts, send them to their profile.
    589             if ( is_multisite() && !get_active_blog_for_user($user->id) )
    590                 $redirect_to = user_admin_url();
    591             elseif ( is_multisite() && !$user->has_cap('read') )
    592                 $redirect_to = get_dashboard_url( $user->id );
    593             elseif ( !$user->has_cap('edit_posts') )
    594                 $redirect_to = admin_url('profile.php');
    595         }
     548        // If the user can't edit posts, send them to their profile.
     549        if ( !$user->has_cap('edit_posts') && ( empty( $redirect_to ) || $redirect_to == 'wp-admin/' || $redirect_to == admin_url() ) )
     550            $redirect_to = admin_url('profile.php');
    596551        wp_safe_redirect($redirect_to);
    597552        exit();
    … …  
    665620</p>
    666621</div>
    667 <p id="backtoblog"><a href="<?php bloginfo('url'); ?>/" title="<?php esc_attr_e('Are you lost?') ?>"><?php printf(__('&larr; Back to %s'), get_bloginfo('title', 'display' )); ?></a></p>
     622<p id="backtoblog"><a href="<?php bloginfo('url'); ?>/" title="<?php _e('Are you lost?') ?>"><?php printf(__('&larr; Back to %s'), get_bloginfo('title', 'display' )); ?></a></p>
    668623<?php } else { ?>
    669624</div>
    … …  
    675630<?php if ( $user_login || $interim_login ) { ?>
    676631d = document.getElementById('user_pass');
    677 d.value = '';
    678632<?php } else { ?>
    679633d = document.getElementById('user_login');
    680 <?php if ( 'invalid_username' == $errors->get_error_code() ) { ?>
    681 if( d.value != '' )
     634<?php } ?>
    682635d.value = '';
    683 <?php
    684 }
    685 }?>
    686636d.focus();
    687 d.select();
    688637} catch(e){}
    689638}, 200);
    … …  
    695644if(typeof wpOnload=='function')wpOnload();
    696645</script>
    697 <?php do_action( 'login_footer' ); ?>
    698646</body>
    699647</html>
Note: See TracChangeset for help on using the changeset viewer.