Changeset 61137

Timestamp:

11/04/2025 06:58:49 PM (5 days ago)

Author:

johnjamesjacoby

Message:

Privacy: Set $request->confirm_key earlier so it can be reused in 2 places.

This commit updates the wp_send_user_request() function so that the updated confirmation key of the request is available to both the confirmation URL and the subsequent filters (specifically user_request_action_email_content).

This maintains the existing behavior of generating a new key just-in-time before every user request email is sent.

Props birgire, dingo_d, garrett-eclipse, johnjamesjacoby.

Fixes #44940.

File:

• trunk/src/wp-includes/user.php (modified) (2 diffs)

trunk/src/wp-includes/user.php

@@ -4845 +4845 @@
     }
 
+    /*
+     * Generate the new user request key first, as it is used by both the $request
+     * object and the confirm_url array.
+     * See https://core.trac.wordpress.org/ticket/44940
+     */
+    $request->confirm_key = wp_generate_user_request_key( $request_id );
+
     $email_data = array(
         'request'     => $request,
@@ -4853 +4860 @@
                 'action'      => 'confirmaction',
                 'request_id'  => $request_id,
-                'confirm_key' => wp_generate_user_request_key( $request_id ),
+                'confirm_key' => $request->confirm_key,
             ),
             wp_login_url()