Changeset 54477

Timestamp:

10/11/2022 01:43:20 PM (2 years ago)

Author:

SergeyBiryukov

Message:

Users: Fetch user by login in retrieve_password() if not found by email.

This ensures that sending a password reset link works as expected if the user's login and email were initially the same, but the email address was subsequently updated and no longer matches the login, which is still set to the old address.

Follow-up to [6643], [18513], [19056], [37474], [50129], [50140].

Props donmhico, pbearne, azouamauriac, boblindner, daxelrod, audrasjb, SergeyBiryukov.
Fixes #53634.

Location:

trunk

Files:

• src/wp-includes/user.php (modified) (1 diff)
• tests/phpunit/tests/user/retrievePassword.php (modified) (2 diffs)

trunk/src/wp-includes/user.php

@@ -3039 +3039 @@
     }
 
+    $user_login = trim( wp_unslash( $user_login ) );
+
     if ( empty( $user_login ) ) {
         $errors->add( 'empty_username', __( '<strong>Error:</strong> Please enter a username or email address.' ) );
     } elseif ( strpos( $user_login, '@' ) ) {
-        $user_data = get_user_by( 'email', trim( wp_unslash( $user_login ) ) );
+        $user_data = get_user_by( 'email', $user_login );
+
+        if ( empty( $user_data ) ) {
+            $user_data = get_user_by( 'login', $user_login );
+        }
+
         if ( empty( $user_data ) ) {
             $errors->add( 'invalid_email', __( '<strong>Error:</strong> There is no account with that username or email address.' ) );
         }
     } else {
-        $user_data = get_user_by( 'login', trim( wp_unslash( $user_login ) ) );
+        $user_data = get_user_by( 'login', $user_login );
     }
 

trunk/tests/phpunit/tests/user/retrievePassword.php

@@ -48 +48 @@
      */
     public function test_retrieve_password_reset_notification_email() {
-        $message = 'Sending password reset notification email failed.';
-        $this->assertNotWPError( retrieve_password( $this->user->user_login ), $message );
+        $this->assertNotWPError( retrieve_password( $this->user->user_login ), 'Sending password reset notification email failed.' );
     }
 
@@ -65 +64 @@
         );
 
-        $message = 'Sending password reset notification email succeeded.';
-        $this->assertWPError( retrieve_password( $this->user->user_login ), $message );
+        $this->assertWPError( retrieve_password( $this->user->user_login ), 'Sending password reset notification email succeeded.' );
+    }
+
+    /**
+     * @ticket 53634
+     */
+    public function test_retrieve_password_should_fetch_user_by_login_if_not_found_by_email() {
+        self::factory()->user->create(
+            array(
+                'user_login' => 'foo@example.com',
+                'user_email' => 'bar@example.com',
+            )
+        );
+
+        $this->assertTrue( retrieve_password( 'foo@example.com' ), 'Fetching user by login failed.' );
+        $this->assertTrue( retrieve_password( 'bar@example.com' ), 'Fetching user by email failed.' );
     }
 }