Changeset 45716

Timestamp:

08/01/2019 07:18:28 PM (5 years ago)

Author:

SergeyBiryukov

Message:

Users: Replace raw SQL query in check_password_reset_key() with get_user_by().

Props davidbaumwald, iworks, spacedmonkey.
Fixes #45845.

File:

• trunk/src/wp-includes/user.php (modified) (4 diffs)

trunk/src/wp-includes/user.php

@@ -2372 +2372 @@
     }
 
-    $row = $wpdb->get_row( $wpdb->prepare( "SELECT ID, user_activation_key FROM $wpdb->users WHERE user_login = %s", $login ) );
-    if ( ! $row ) {
+    $user = get_user_by( 'login', $login );
+
+    if ( ! $user ) {
         return new WP_Error( 'invalid_key', __( 'Invalid key.' ) );
     }
@@ -2391 +2392 @@
     $expiration_duration = apply_filters( 'password_reset_expiration', DAY_IN_SECONDS );
 
-    if ( false !== strpos( $row->user_activation_key, ':' ) ) {
-        list( $pass_request_time, $pass_key ) = explode( ':', $row->user_activation_key, 2 );
+    if ( false !== strpos( $user->user_activation_key, ':' ) ) {
+        list( $pass_request_time, $pass_key ) = explode( ':', $user->user_activation_key, 2 );
         $expiration_time                      = $pass_request_time + $expiration_duration;
     } else {
-        $pass_key        = $row->user_activation_key;
+        $pass_key        = $user->user_activation_key;
         $expiration_time = false;
     }
@@ -2406 +2407 @@
 
     if ( $hash_is_correct && $expiration_time && time() < $expiration_time ) {
-        return get_userdata( $row->ID );
+        return $user;
     } elseif ( $hash_is_correct && $expiration_time ) {
         // Key has an expiration time that's passed
@@ -2412 +2413 @@
     }
 
-    if ( hash_equals( $row->user_activation_key, $key ) || ( $hash_is_correct && ! $expiration_time ) ) {
+    if ( hash_equals( $user->user_activation_key, $key ) || ( $hash_is_correct && ! $expiration_time ) ) {
         $return  = new WP_Error( 'expired_key', __( 'Invalid key.' ) );
-        $user_id = $row->ID;
+        $user_id = $user->ID;
 
         /**