Changeset 56150 for trunk/src/wp-includes/user.php

Timestamp:

07/06/2023 12:45:45 PM (15 months ago)

Author:

audrasjb

Message:

Users: Remove password reset links when the feature is not allowed for a specific user.

This also introduces wp_is_password_reset_allowed_for_user() which returns false when password reset is not allowed for a specific user. This can be
filtered by developers using the existing allow_password_reset hook.

Props ocean90, cshark, robinwpdeveloper, tahmina1du, kraftbj.
Fixes #58194.

File:

• trunk/src/wp-includes/user.php (modified) (2 diffs)

trunk/src/wp-includes/user.php

@@ -2898 +2898 @@
     do_action( 'retrieve_password', $user->user_login );
 
-    $allow = true;
-    if ( is_multisite() && is_user_spammy( $user ) ) {
-        $allow = false;
-    }
-
-    /**
-     * Filters whether to allow a password to be reset.
-     *
-     * @since 2.7.0
-     *
-     * @param bool $allow   Whether to allow the password to be reset. Default true.
-     * @param int  $user_id The ID of the user attempting to reset a password.
-     */
-    $allow = apply_filters( 'allow_password_reset', $allow, $user->ID );
-
-    if ( ! $allow ) {
+    $password_reset_allowed = wp_is_password_reset_allowed_for_user( $user );
+    if ( ! $password_reset_allowed ) {
         return new WP_Error( 'no_password_reset', __( 'Password reset is not allowed for this user' ) );
-    } elseif ( is_wp_error( $allow ) ) {
-        return $allow;
+    } elseif ( is_wp_error( $password_reset_allowed ) ) {
+        return $password_reset_allowed;
     }
 
@@ -5038 +5024 @@
     wp_cache_set_last_changed( 'users' );
 }
+
+/**
+ * Checks if password reset is allowed for a specific user.
+ *
+ * @since 6.3.0
+ *
+ * @param int|WP_User $user The user to check.
+ * @return bool|WP_Error True if allowed, false or WP_Error otherwise.
+ */
+function wp_is_password_reset_allowed_for_user( $user ) {
+    if ( ! is_object( $user ) ) {
+        $user = get_userdata( $user );
+    }
+
+    if ( ! $user || ! $user->exists() ) {
+        return false;
+    }
+    $allow = true;
+    if ( is_multisite() && is_user_spammy( $user ) ) {
+        $allow = false;
+    }
+
+    /**
+     * Filters whether to allow a password to be reset.
+     *
+     * @since 2.7.0
+     *
+     * @param bool $allow   Whether to allow the password to be reset. Default true.
+     * @param int  $user_id The ID of the user attempting to reset a password.
+     */
+    return apply_filters( 'allow_password_reset', $allow, $user->ID );
+}