Changeset 58333 for trunk/src/wp-includes/user.php

Timestamp:

06/04/2024 02:42:29 PM (3 months ago)

Author:

audrasjb

Message:

Login and Registration: Flush user_activation_key after successfully login.

This changeset ensures the user_activation_key is flushed after successful login, so reset password links can not be used anymore after the user successfully log into their dashboard.

Props nsinelnikov, rajinsharwar, Rahmohn, oglekler, hellofromTonya.
Fixes #58901.
See #32429

File:

• trunk/src/wp-includes/user.php (modified) (1 diff)

trunk/src/wp-includes/user.php

@@ -111 +111 @@
 
     wp_set_auth_cookie( $user->ID, $credentials['remember'], $secure_cookie );
+
+    /**
+     * @global wpdb $wpdb WordPress database abstraction object.
+     */
+    global $wpdb;
+
+    // Flush `user_activation_key` if exists after successful login.
+    if ( ! empty( $user->user_activation_key ) ) {
+        $wpdb->update(
+            $wpdb->users,
+            array(
+                'user_activation_key' => '',
+            ),
+            array( 'ID' => $user->ID ),
+            array( '%s' ),
+            array( '%d' )
+        );
+
+        // Empty user_activation_key object.
+        $user->user_activation_key = '';
+    }
+
     /**
      * Fires after the user has successfully logged in.