Changeset 60634

Timestamp:

08/13/2025 08:12:46 PM (12 months ago)

Author:

davidbaumwald

Message:

Users: Fire wp_set_password action when creating or updating a user's password.

Various filters and actions fire during user creation and editing, making available all manner of user data to be acted upon by custom code. However, a user's password was not included in the data that was made available.

This change now fires an existing action, wp_set_password, during initial user creation and when an existing user's password is updated.

Props ChloeD, scribu, dd32, pento, chriscct7, johnbillion, logicrays, nimeshatxecurify.
Fixes #22114.

Location:

trunk

Files:

• src/wp-includes/user.php (modified) (2 diffs)
• tests/phpunit/tests/user.php (modified) (1 diff)

trunk/src/wp-includes/user.php

@@ -2502 +2502 @@
         $user = new WP_User( $user_id );
 
+        if ( ! $update ) {
+                /** This action is documented in wp-includes/pluggable.php */
+                do_action( 'wp_set_password', $userdata['user_pass'], $user_id, $userdata );
+        }
+
         /**
          * Filters a user's meta values and keys immediately after the user is created or updated
@@ -2684 +2689 @@
                 $plaintext_pass        = $userdata['user_pass'];
                 $userdata['user_pass'] = wp_hash_password( $userdata['user_pass'] );
+
+                /** This action is documented in wp-includes/pluggable.php */
+                do_action( 'wp_set_password', $plaintext_pass, $user_id, $user_obj );
 
                 /**

trunk/tests/phpunit/tests/user.php

@@ -2354 +2354 @@
                 $this->assertSame( 1, $db_update_count );
         }
+
+        /**
+         * Tests that `wp_set_password` action is triggered correctly during `wp_insert_user()`.
+         *
+         * @ticket 22114
+         */
+        public function test_set_password_action_fires_during_wp_insert_user() {
+                $mock_action = new MockAction();
+
+                add_action( 'wp_set_password', array( $mock_action, 'action' ), 10, 3 );
+
+                $userdata = array(
+                        'user_login' => 'testuser_' . wp_rand(),
+                        'user_pass'  => 'initialpassword',
+                        'user_email' => 'testuser@example.com',
+                );
+
+                $user_id = wp_insert_user( $userdata );
+
+                // Assert that `wp_set_password` was triggered once during user creation.
+                $this->assertSame( 1, $mock_action->get_call_count(), 'wp_set_password was not triggered during user creation.' );
+
+                $args = $mock_action->get_args();
+
+                $this->assertSame( $userdata['user_pass'], $args[0][0], 'Wrong password argument in action.' );
+                $this->assertSame( $user_id, $args[0][1], 'Wrong user ID in action.' );
+        }
+
+        /**
+         * Tests that `wp_set_password` action is triggered correctly during `wp_update_user()`.
+         *
+         * @ticket 22114
+         */
+        public function test_set_password_action_on_user_update() {
+                $mock_action = new MockAction();
+
+                add_action( 'wp_set_password', array( $mock_action, 'action' ), 10, 3 );
+
+                $user_id = $this->factory()->user->create(
+                        array(
+                                'role'       => 'subscriber',
+                                'user_login' => 'testuser_update',
+                                'user_email' => 'testuser_update@example.com',
+                                'user_pass'  => 'initialpassword',
+                        )
+                );
+
+                $mock_action->reset();
+
+                $updated_password = 'newpassword123';
+
+                $userdata = array(
+                        'ID'        => $user_id,
+                        'user_pass' => $updated_password,
+                );
+
+                wp_update_user( $userdata );
+
+                $this->assertSame( 1, $mock_action->get_call_count(), 'wp_set_password was not triggered during password update.' );
+
+                $args = $mock_action->get_args();
+
+                $this->assertSame( $updated_password, $args[0][0], 'Invalid password in wp_set_password action.' );
+                $this->assertSame( $user_id, $args[0][1], 'Invalid user ID in wp_set_password action.' );
+        }
 }