Changeset 37317

Timestamp:

04/27/2016 05:54:40 AM (8 years ago)

Author:

jeremyfelt

Message:

Users: Prevent spammy users from resetting their passwords in multisite

Props r-a-y, websupporter.
Fixes #24617.

File:

• trunk/src/wp-includes/user.php (modified) (2 diffs)

trunk/src/wp-includes/user.php

@@ -2037 +2037 @@
     do_action( 'retrieve_password', $user->user_login );
 
+    $allow = true;
+    if ( is_multisite() && is_user_spammy( $user ) ) {
+        $allow = false;
+    }
+
     /**
      * Filter whether to allow a password to be reset.
@@ -2045 +2050 @@
      * @param int  $user_data->ID The ID of the user attempting to reset a password.
      */
-    $allow = apply_filters( 'allow_password_reset', true, $user->ID );
+    $allow = apply_filters( 'allow_password_reset', $allow, $user->ID );
 
     if ( ! $allow ) {