Changeset 54477 for trunk/src/wp-includes/user.php

Timestamp:

10/11/2022 01:43:20 PM (2 years ago)

Author:

SergeyBiryukov

Message:

Users: Fetch user by login in retrieve_password() if not found by email.

This ensures that sending a password reset link works as expected if the user's login and email were initially the same, but the email address was subsequently updated and no longer matches the login, which is still set to the old address.

Follow-up to [6643], [18513], [19056], [37474], [50129], [50140].

Props donmhico, pbearne, azouamauriac, boblindner, daxelrod, audrasjb, SergeyBiryukov.
Fixes #53634.

File:

• trunk/src/wp-includes/user.php (modified) (1 diff)

trunk/src/wp-includes/user.php

@@ -3039 +3039 @@
     }
 
+    $user_login = trim( wp_unslash( $user_login ) );
+
     if ( empty( $user_login ) ) {
         $errors->add( 'empty_username', __( '<strong>Error:</strong> Please enter a username or email address.' ) );
     } elseif ( strpos( $user_login, '@' ) ) {
-        $user_data = get_user_by( 'email', trim( wp_unslash( $user_login ) ) );
+        $user_data = get_user_by( 'email', $user_login );
+
+        if ( empty( $user_data ) ) {
+            $user_data = get_user_by( 'login', $user_login );
+        }
+
         if ( empty( $user_data ) ) {
             $errors->add( 'invalid_email', __( '<strong>Error:</strong> There is no account with that username or email address.' ) );
         }
     } else {
-        $user_data = get_user_by( 'login', trim( wp_unslash( $user_login ) ) );
+        $user_data = get_user_by( 'login', $user_login );
     }