Changeset 47634

Timestamp:

04/29/2020 03:23:37 PM (4 years ago)

Author:

whyisjake

Message:

User: Invalidate user_activation_key on password update.

Props: sstoqnov, sergeybiryukov.

Location:

trunk

Files:

• src/wp-includes/user.php (modified) (1 diff)
• tests/phpunit/tests/user.php (modified) (2 diffs)

trunk/src/wp-includes/user.php

@@ -1813 +1813 @@
 
     if ( $update ) {
-        if ( $user_email !== $old_user_data->user_email ) {
+        if ( $user_email !== $old_user_data->user_email || $user_pass !== $old_user_data->user_pass ) {
             $data['user_activation_key'] = '';
         }

trunk/tests/phpunit/tests/user.php

@@ -1037 +1037 @@
     }
 
-    function test_changing_email_invalidates_password_reset_key() {
+    public function test_changing_email_invalidates_password_reset_key() {
         global $wpdb;
 
@@ -1062 +1062 @@
             'user_nicename' => 'cat',
             'user_email'    => 'foo@bar.dev',
+        );
+        wp_update_user( $userdata );
+
+        $user = get_userdata( $user->ID );
+        $this->assertEmpty( $user->user_activation_key );
+    }
+
+    public function test_changing_password_invalidates_password_reset_key() {
+        global $wpdb;
+
+        $user = $this->author;
+        $wpdb->update( $wpdb->users, array( 'user_activation_key' => 'key' ), array( 'ID' => $user->ID ) );
+        clean_user_cache( $user );
+
+        $user = get_userdata( $user->ID );
+        $this->assertEquals( 'key', $user->user_activation_key );
+
+        $userdata = array(
+            'ID'        => $user->ID,
+            'user_pass' => 'password',
         );
         wp_update_user( $userdata );