WordPress.org

Make WordPress Core

Changeset 47634


Ignore:
Timestamp:
04/29/2020 03:23:37 PM (2 months ago)
Author:
whyisjake
Message:

User: Invalidate user_activation_key on password update.

Props: sstoqnov, sergeybiryukov.

Location:
trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/user.php

    r47611 r47634  
    18131813
    18141814    if ( $update ) {
    1815         if ( $user_email !== $old_user_data->user_email ) {
     1815        if ( $user_email !== $old_user_data->user_email || $user_pass !== $old_user_data->user_pass ) {
    18161816            $data['user_activation_key'] = '';
    18171817        }
  • trunk/tests/phpunit/tests/user.php

    r47279 r47634  
    10371037    }
    10381038
    1039     function test_changing_email_invalidates_password_reset_key() {
     1039    public function test_changing_email_invalidates_password_reset_key() {
    10401040        global $wpdb;
    10411041
     
    10621062            'user_nicename' => 'cat',
    10631063            'user_email'    => 'foo@bar.dev',
     1064        );
     1065        wp_update_user( $userdata );
     1066
     1067        $user = get_userdata( $user->ID );
     1068        $this->assertEmpty( $user->user_activation_key );
     1069    }
     1070
     1071    public function test_changing_password_invalidates_password_reset_key() {
     1072        global $wpdb;
     1073
     1074        $user = $this->author;
     1075        $wpdb->update( $wpdb->users, array( 'user_activation_key' => 'key' ), array( 'ID' => $user->ID ) );
     1076        clean_user_cache( $user );
     1077
     1078        $user = get_userdata( $user->ID );
     1079        $this->assertEquals( 'key', $user->user_activation_key );
     1080
     1081        $userdata = array(
     1082            'ID'        => $user->ID,
     1083            'user_pass' => 'password',
    10641084        );
    10651085        wp_update_user( $userdata );
Note: See TracChangeset for help on using the changeset viewer.