Changeset 37317

Timestamp:

04/27/2016 05:54:40 AM (10 years ago)

Author:

jeremyfelt

Message:

Users: Prevent spammy users from resetting their passwords in multisite

Props r-a-y, websupporter.
Fixes #24617.

File:

• trunk/src/wp-includes/user.php (modified) (2 diffs)

trunk/src/wp-includes/user.php

@@ -2037 +2037 @@
         do_action( 'retrieve_password', $user->user_login );
 
+        $allow = true;
+        if ( is_multisite() && is_user_spammy( $user ) ) {
+                $allow = false;
+        }
+
         /**
          * Filter whether to allow a password to be reset.
@@ -2045 +2050 @@
          * @param int  $user_data->ID The ID of the user attempting to reset a password.
          */
-        $allow = apply_filters( 'allow_password_reset', true, $user->ID );
+        $allow = apply_filters( 'allow_password_reset', $allow, $user->ID );
 
         if ( ! $allow ) {