WordPress.org
Get WordPress

Make WordPress Core


Ignore:
File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/wp-login.php

    r15090 r17465  
    8080    }
    8181
    82     do_action('login_head'); ?>
     82    do_action( 'login_enqueue_scripts' );
     83    do_action( 'login_head' ); ?>
    8384</head>
    8485<body class="login">
    8586<?php   if ( !is_multisite() ) { ?>
    86 <div id="login"><h1><a href="<?php echo apply_filters('login_headerurl', 'http://wordpress.org/'); ?>" title="<?php echo apply_filters('login_headertitle', __('Powered by WordPress')); ?>"><?php bloginfo('name'); ?></a></h1>
     87<div id="login"><h1><a href="<?php echo apply_filters('login_headerurl', 'http://wordpress.org/'); ?>" title="<?php echo apply_filters('login_headertitle', esc_attr__('Powered by WordPress')); ?>"><?php bloginfo('name'); ?></a></h1>
    8788<?php   } else { ?>
    88 <div id="login"><h1><a href="<?php echo apply_filters('login_headerurl', network_home_url() ); ?>" title="<?php echo apply_filters('login_headertitle', $current_site->site_name ); ?>"><span class="hide"><?php bloginfo('name'); ?></span></a></h1>
     89<div id="login"><h1><a href="<?php echo apply_filters('login_headerurl', network_home_url() ); ?>" title="<?php echo apply_filters('login_headertitle', esc_attr($current_site->site_name) ); ?>"><span class="hide"><?php bloginfo('name'); ?></span></a></h1>
    8990<?php   }
    9091
    … …  
    116117    }
    117118} // End of login_header()
     119
     120/**
     121 * Outputs the footer for the login page.
     122 *
     123 * @param string $input_id Which input to auto-focus
     124 */
     125function login_footer($input_id = '') {
     126    echo "</div>\n";
     127
     128    if ( !empty($input_id) ) {
     129?>
     130<script type="text/javascript">
     131try{document.getElementById('<?php echo $input_id; ?>').focus();}catch(e){}
     132if(typeof wpOnload=='function')wpOnload();
     133</script>
     134<?php
     135    }
     136?>
     137<p id="backtoblog"><a href="<?php bloginfo('url'); ?>/" title="<?php esc_attr_e('Are you lost?') ?>"><?php printf(__('&larr; Back to %s'), get_bloginfo('title', 'display' )); ?></a></p>
     138<?php do_action('login_footer'); ?>
     139</body>
     140</html>
     141<?php
     142}
     143
    118144function wp_shake_js() {
    119145    global $is_iphone;
    … …  
    187213        $wpdb->update($wpdb->users, array('user_activation_key' => $key), array('user_login' => $user_login));
    188214    }
    189     $message = __('Someone has asked to reset the password for the following site and username.') . "\r\n\r\n";
     215    $message = __('Someone requested that the password be reset for the following account:') . "\r\n\r\n";
    190216    $message .= network_site_url() . "\r\n\r\n";
    191217    $message .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n";
    192     $message .= __('To reset your password visit the following address, otherwise just ignore this email and nothing will happen.') . "\r\n\r\n";
    193     $message .= network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . "\r\n";
     218    $message .= __('If this was a mistake, just ignore this email and nothing will happen.') . "\r\n\r\n";
     219    $message .= __('To reset your password, visit the following address:') . "\r\n\r\n";
     220    $message .= '<' . network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . ">\r\n";
    194221
    195222    if ( is_multisite() )
    … …  
    212239
    213240/**
    214  * Handles resetting the user's password.
     241 * Retrieves a user row based on password reset key and login
    215242 *
    216243 * @uses $wpdb WordPress Database object
    217244 *
    218245 * @param string $key Hash to validate sending user's password
    219  * @return bool|WP_Error
     246 * @param string $login The user login
     247 *
     248 * @return object|WP_Error
    220249 */
    221 function reset_password($key, $login) {
     250function check_password_reset_key($key, $login) {
    222251    global $wpdb;
    223252
    … …  
    231260
    232261    $user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_activation_key = %s AND user_login = %s", $key, $login));
     262
    233263    if ( empty( $user ) )
    234264        return new WP_Error('invalid_key', __('Invalid key'));
    235265
    236     // Generate something random for a password...
    237     $new_pass = wp_generate_password();
    238 
     266    return $user;
     267}
     268
     269/**
     270 * Handles resetting the user's password.
     271 *
     272 * @uses $wpdb WordPress Database object
     273 *
     274 * @param string $key Hash to validate sending user's password
     275 */
     276function reset_password($user, $new_pass) {
    239277    do_action('password_reset', $user, $new_pass);
    240278
    241279    wp_set_password($new_pass, $user->ID);
    242     update_user_option($user->ID, 'default_password_nag', true, true); //Set up the Password change nag.
    243     $message  = sprintf(__('Username: %s'), $user->user_login) . "\r\n";
    244     $message .= sprintf(__('Password: %s'), $new_pass) . "\r\n";
    245     $message .= site_url('wp-login.php', 'login') . "\r\n";
    246 
    247     if ( is_multisite() )
    248         $blogname = $GLOBALS['current_site']->site_name;
    249     else
    250         // The blogname option is escaped with esc_html on the way into the database in sanitize_option
    251         // we want to reverse this for the plain text arena of emails.
    252         $blogname = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES);
    253 
    254     $title = sprintf( __('[%s] Your new password'), $blogname );
    255 
    256     $title = apply_filters('password_reset_title', $title);
    257     $message = apply_filters('password_reset_message', $message, $new_pass);
    258 
    259     if ( $message && !wp_mail($user->user_email, $title, $message) )
    260         wp_die( __('The e-mail could not be sent.') . "<br />\n" . __('Possible reason: your host may have disabled the mail() function...') );
    261280
    262281    wp_password_change_notification($user);
    263 
    264     return true;
    265282}
    266283
    … …  
    305322        return $errors;
    306323
    307     $user_pass = wp_generate_password();
     324    $user_pass = wp_generate_password( 12, false);
    308325    $user_id = wp_create_user( $sanitized_user_login, $user_pass, $user_email );
    309326    if ( ! $user_id ) {
    … …  
    369386case 'lostpassword' :
    370387case 'retrievepassword' :
     388
    371389    if ( $http_post ) {
    372390        $errors = retrieve_password();
    … …  
    382400
    383401    do_action('lost_password');
    384     login_header(__('Lost Password'), '<p class="message">' . __('Please enter your username or e-mail address. You will receive a new password via e-mail.') . '</p>', $errors);
     402    login_header(__('Lost Password'), '<p class="message">' . __('Please enter your username or email address. You will receive a link to create a new password via email.') . '</p>', $errors);
    385403
    386404    $user_login = isset($_POST['user_login']) ? stripslashes($_POST['user_login']) : '';
    … …  
    399417
    400418<p id="nav">
     419<a href="<?php echo site_url('wp-login.php', 'login') ?>"><?php _e('Log in') ?></a>
    401420<?php if (get_option('users_can_register')) : ?>
    402 <a href="<?php echo site_url('wp-login.php', 'login') ?>"><?php _e('Log in') ?></a> |
    403 <a href="<?php echo site_url('wp-login.php?action=register', 'login') ?>"><?php _e('Register') ?></a>
    404 <?php else : ?>
    405 <a href="<?php echo site_url('wp-login.php', 'login') ?>"><?php _e('Log in') ?></a>
     421 | <a href="<?php echo site_url('wp-login.php?action=register', 'login') ?>"><?php _e('Register') ?></a>
    406422<?php endif; ?>
    407423</p>
    408424
    409 </div>
    410 
    411 <p id="backtoblog"><a href="<?php bloginfo('url'); ?>/" title="<?php _e('Are you lost?') ?>"><?php printf(__('&larr; Back to %s'), get_bloginfo('title', 'display' )); ?></a></p>
    412 
    413 <script type="text/javascript">
    414 try{document.getElementById('user_login').focus();}catch(e){}
    415 if(typeof wpOnload=='function')wpOnload();
    416 </script>
    417 </body>
    418 </html>
    419 <?php
     425<?php
     426login_footer('user_login');
    420427break;
    421428
    422429case 'resetpass' :
    423430case 'rp' :
    424     $errors = reset_password($_GET['key'], $_GET['login']);
    425 
    426     if ( ! is_wp_error($errors) ) {
    427         wp_redirect('wp-login.php?checkemail=newpass');
    428         exit();
    429     }
    430 
    431     wp_redirect('wp-login.php?action=lostpassword&error=invalidkey');
    432     exit();
    433 
     431    $user = check_password_reset_key($_GET['key'], $_GET['login']);
     432
     433    if ( is_wp_error($user) ) {
     434        wp_redirect( site_url('wp-login.php?action=lostpassword&error=invalidkey') );
     435        exit;
     436    }
     437
     438    $errors = '';
     439
     440    if ( isset($_POST['pass1']) && $_POST['pass1'] != $_POST['pass2'] ) {
     441        $errors = new WP_Error('password_reset_mismatch', __('The passwords do not match.'));
     442    } elseif ( isset($_POST['pass1']) && !empty($_POST['pass1']) ) {
     443        reset_password($user, $_POST['pass1']);
     444        login_header(__('Password Reset'), '<p class="message reset-pass">' . __('Your password has been reset.') . ' <a href="' . site_url('wp-login.php', 'login') . '">' . __('Log in') . '</a></p>');
     445        login_footer();
     446        exit;
     447    }
     448
     449    wp_enqueue_script('utils');
     450    wp_enqueue_script('user-profile');
     451
     452    login_header(__('Reset Password'), '<p class="message reset-pass">' . __('Enter your new password below.') . '</p>', $errors );
     453
     454?>
     455<form name="resetpassform" id="resetpassform" action="<?php echo site_url('wp-login.php?action=resetpass&key=' . urlencode($_GET['key']) . '&login=' . urlencode($_GET['login']), 'login_post') ?>" method="post">
     456    <input type="hidden" id="user_login" value="<?php echo esc_attr( $_GET['login'] ); ?>" autocomplete="off" />
     457
     458    <p>
     459        <label><?php _e('New password') ?><br />
     460        <input type="password" name="pass1" id="pass1" class="input" size="20" value="" autocomplete="off" /></label>
     461    </p>
     462    <p>
     463        <label><?php _e('Confirm new password') ?><br />
     464        <input type="password" name="pass2" id="pass2" class="input" size="20" value="" autocomplete="off" /></label>
     465    </p>
     466
     467    <div id="pass-strength-result" class="hide-if-no-js"><?php _e('Strength indicator'); ?></div>
     468    <p class="description indicator-hint"><?php _e('Hint: The password should be at least seven characters long. To make it stronger, use upper and lower case letters, numbers and symbols like ! " ? $ % ^ &amp; ).'); ?></p>
     469
     470    <br class="clear" />
     471    <p class="submit"><input type="submit" name="wp-submit" id="wp-submit" class="button-primary" value="<?php esc_attr_e('Reset Password'); ?>" tabindex="100" /></p>
     472</form>
     473
     474<p id="nav">
     475<a href="<?php echo site_url('wp-login.php', 'login') ?>"><?php _e('Log in') ?></a>
     476<?php if (get_option('users_can_register')) : ?>
     477 | <a href="<?php echo site_url('wp-login.php?action=register', 'login') ?>"><?php _e('Register') ?></a>
     478<?php endif; ?>
     479</p>
     480
     481<?php
     482login_footer('user_pass');
    434483break;
    435484
    … …  
    437486    if ( is_multisite() ) {
    438487        // Multisite uses wp-signup.php
    439         wp_redirect( apply_filters( 'wp_signup_location', get_bloginfo('wpurl') . '/wp-signup.php' ) );
     488        wp_redirect( apply_filters( 'wp_signup_location', site_url('wp-signup.php') ) );
    440489        exit;
    441490    }
    442491
    443492    if ( !get_option('users_can_register') ) {
    444         wp_redirect('wp-login.php?registration=disabled');
     493        wp_redirect( site_url('wp-login.php?registration=disabled') );
    445494        exit();
    446495    }
    … …  
    449498    $user_email = '';
    450499    if ( $http_post ) {
    451         require_once( ABSPATH . WPINC . '/registration.php');
    452 
    453500        $user_login = $_POST['user_login'];
    454501        $user_email = $_POST['user_email'];
    … …  
    486533</p>
    487534
    488 </div>
    489 
    490 <p id="backtoblog"><a href="<?php bloginfo('url'); ?>/" title="<?php _e('Are you lost?') ?>"><?php printf(__('&larr; Back to %s'), get_bloginfo('title', 'display' )); ?></a></p>
    491 
    492 <script type="text/javascript">
    493 try{document.getElementById('user_login').focus();}catch(e){}
    494 if(typeof wpOnload=='function')wpOnload();
    495 </script>
    496 </body>
    497 </html>
    498 <?php
     535<?php
     536login_footer('user_login');
    499537break;
    500538
    … …  
    546584<?php       exit;
    547585        }
    548         // If the user can't edit posts, send them to their profile.
    549         if ( !$user->has_cap('edit_posts') && ( empty( $redirect_to ) || $redirect_to == 'wp-admin/' || $redirect_to == admin_url() ) )
    550             $redirect_to = admin_url('profile.php');
     586
     587        if ( ( empty( $redirect_to ) || $redirect_to == 'wp-admin/' || $redirect_to == admin_url() ) ) {
     588            // If the user doesn't belong to a blog, send them to user admin. If the user can't edit posts, send them to their profile.
     589            if ( is_multisite() && !get_active_blog_for_user($user->id) )
     590                $redirect_to = user_admin_url();
     591            elseif ( is_multisite() && !$user->has_cap('read') )
     592                $redirect_to = get_dashboard_url( $user->id );
     593            elseif ( !$user->has_cap('edit_posts') )
     594                $redirect_to = admin_url('profile.php');
     595        }
    551596        wp_safe_redirect($redirect_to);
    552597        exit();
    … …  
    620665</p>
    621666</div>
    622 <p id="backtoblog"><a href="<?php bloginfo('url'); ?>/" title="<?php _e('Are you lost?') ?>"><?php printf(__('&larr; Back to %s'), get_bloginfo('title', 'display' )); ?></a></p>
     667<p id="backtoblog"><a href="<?php bloginfo('url'); ?>/" title="<?php esc_attr_e('Are you lost?') ?>"><?php printf(__('&larr; Back to %s'), get_bloginfo('title', 'display' )); ?></a></p>
    623668<?php } else { ?>
    624669</div>
    … …  
    630675<?php if ( $user_login || $interim_login ) { ?>
    631676d = document.getElementById('user_pass');
     677d.value = '';
    632678<?php } else { ?>
    633679d = document.getElementById('user_login');
    634 <?php } ?>
     680<?php if ( 'invalid_username' == $errors->get_error_code() ) { ?>
     681if( d.value != '' )
    635682d.value = '';
     683<?php
     684}
     685}?>
    636686d.focus();
     687d.select();
    637688} catch(e){}
    638689}, 200);
    … …  
    644695if(typeof wpOnload=='function')wpOnload();
    645696</script>
     697<?php do_action( 'login_footer' ); ?>
    646698</body>
    647699</html>
Note: See TracChangeset for help on using the changeset viewer.