Changes in branches/2.8 [11770:11806]

Location:

branches/2.8

Files:

• readme.html (modified) (2 diffs)
• wp-includes/version.php (modified) (1 diff)
• wp-login.php (modified) (3 diffs)

branches/2.8/readme.html

@@ -9 +9 @@
 <h1 id="logo" style="text-align: center">
     <img alt="WordPress" src="wp-admin/images/wordpress-logo.png" />
-    <br /> Version 2.8.3
+    <br /> Version 2.8.4
 </h1>
 <p style="text-align: center">Semantic Personal Publishing Platform</p>
@@ -30 +30 @@
 <h1>Upgrading</h1>
 <p>Before you upgrade anything, make sure you have backup copies of any files you may have modified such as <code>index.php</code>.</p>
-<h2>Upgrading from any previous WordPress to 2.8.3:</h2>
+<h2>Upgrading from any previous WordPress to 2.8.4:</h2>
 <ol>
     <li>Delete your old WP files, saving ones you've modified.</li>

branches/2.8/wp-includes/version.php

@@ -9 +9 @@
  * @global string $wp_version
  */
-$wp_version = '2.8.3';
+$wp_version = '2.8.4';
 
 /**

branches/2.8/wp-login.php

@@ -162 +162 @@
     $message .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n";
     $message .= __('To reset your password visit the following address, otherwise just ignore this email and nothing will happen.') . "\r\n\r\n";
-    $message .= site_url("wp-login.php?action=rp&key=$key", 'login') . "\r\n";
+    $message .= site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . "\r\n";
 
     $title = sprintf(__('[%s] Password Reset'), get_option('blogname'));
@@ -183 +183 @@
  * @return bool|WP_Error
  */
-function reset_password($key) {
+function reset_password($key, $login) {
     global $wpdb;
 
     $key = preg_replace('/[^a-z0-9]/i', '', $key);
 
-    if ( empty( $key ) )
+    if ( empty( $key ) || !is_string( $key ) )
         return new WP_Error('invalid_key', __('Invalid key'));
 
-    $user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_activation_key = %s", $key));
+    if ( empty($login) || !is_string($login) )
+        return new WP_Error('invalid_key', __('Invalid key'));
+
+    $user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_activation_key = %s AND user_login = %s", $key, $login));
     if ( empty( $user ) )
         return new WP_Error('invalid_key', __('Invalid key'));
@@ -371 +374 @@
 case 'resetpass' :
 case 'rp' :
-    $errors = reset_password($_GET['key']);
+    $errors = reset_password($_GET['key'], $_GET['login']);
 
     if ( ! is_wp_error($errors) ) {