Changeset 37474 for trunk/src/wp-login.php

Timestamp:

05/20/2016 07:20:44 PM (8 years ago)

Author:

boonebgorges

Message:

During password reset, user-submitted login/email should be stripslashed.

This prevents errors when an email address contains an apostrophe. See [29966]
for similar treatment of a related problem.

Props dcavins.
Fixes #36322.

File:

• trunk/src/wp-login.php (modified) (1 diff)

trunk/src/wp-login.php

@@ -295 +295 @@
         $errors->add('empty_username', __('<strong>ERROR</strong>: Enter a username or email address.'));
     } elseif ( strpos( $_POST['user_login'], '@' ) ) {
-        $user_data = get_user_by( 'email', trim( $_POST['user_login'] ) );
+        $user_data = get_user_by( 'email', trim( wp_unslash( $_POST['user_login'] ) ) );
         if ( empty( $user_data ) )
             $errors->add('invalid_email', __('<strong>ERROR</strong>: There is no user registered with that email address.'));