Changeset 44602 for trunk/src/wp-includes/user.php

Timestamp:

01/15/2019 06:26:23 AM (6 years ago)

Author:

pento

Message:

Users: Check that a valid user is passed to get_password_reset_key().

Props edocev.
Fixes #44601.

File:

• trunk/src/wp-includes/user.php (modified) (1 diff)

trunk/src/wp-includes/user.php

@@ -2218 +2218 @@
     global $wpdb, $wp_hasher;
 
+    if ( ! ( $user instanceof WP_User ) ) {
+        return new WP_Error( 'invalidcombo', __( '<strong>ERROR</strong>: There is no account with that username or email address.' ) );
+    }
+
     /**
      * Fires before a new password is retrieved.