Index: src/wp-admin/admin-ajax.php =================================================================== --- src/wp-admin/admin-ajax.php (revisione 35561) +++ src/wp-admin/admin-ajax.php (copia locale) @@ -62,7 +62,7 @@ 'send-attachment-to-editor', 'save-attachment-order', 'heartbeat', 'get-revision-diffs', 'save-user-color-scheme', 'update-widget', 'query-themes', 'parse-embed', 'set-attachment-thumbnail', 'parse-media-shortcode', 'destroy-sessions', 'install-plugin', 'update-plugin', 'press-this-save-post', - 'press-this-add-category', 'crop-image', 'generate-password', 'save-wporg-username', + 'press-this-add-category', 'crop-image', 'generate-password', 'save-wporg-username', 'send-password-reset', ); // Deprecated Index: src/wp-admin/includes/ajax-actions.php =================================================================== --- src/wp-admin/includes/ajax-actions.php (revisione 35561) +++ src/wp-admin/includes/ajax-actions.php (copia locale) @@ -3316,3 +3316,37 @@ wp_send_json_success( update_user_meta( get_current_user_id(), 'wporg_favorites', $username ) ); } + +/** + * Ajax handler sends a password reset link. + * + * @since 4.4.0 + */ +function wp_ajax_send_password_reset() { + + // Validate the nonce for this action. + $user_id = isset( $_POST['user_id'] ) ? (int) $_POST['user_id'] : 0; + check_ajax_referer( 'reset-password-for-' . $user_id, 'nonce' ); + + // Verify user capabilities. + if ( ! current_user_can( 'edit_user', $user_id ) ) { + wp_send_json_error( __( 'Cannot send password reset, permission denied.' ) ); + } + + // Send the password reset. + $user = get_userdata( $user_id ); + + // Pass the username via $_POST. + $_POST['user_login'] = esc_attr( $user->user_login ); + + $results = retrieve_password(); + + if ( true === $results ) { + wp_send_json_success( + /* translators: 1: User's display name. */ + sprintf( __( 'A password reset link was emailed to %s.' ), $user->display_name ) + ); + } else { + wp_send_json_error( $results ); + } +} Index: src/wp-admin/includes/class-wp-users-list-table.php =================================================================== --- src/wp-admin/includes/class-wp-users-list-table.php (revisione 35561) +++ src/wp-admin/includes/class-wp-users-list-table.php (copia locale) @@ -242,8 +242,14 @@ } else { if ( current_user_can( 'delete_users' ) ) $actions['delete'] = __( 'Delete' ); + } + // Add a password reset link to the bulk actions dropdown. + if ( current_user_can( 'edit_users' ) ) { + $actions['resetpassword'] = __( 'Send password reset' ); + } + return $actions; } @@ -410,7 +416,11 @@ $actions['delete'] = "" . __( 'Delete' ) . ""; if ( is_multisite() && get_current_user_id() != $user_object->ID && current_user_can( 'remove_user', $user_object->ID ) ) $actions['remove'] = "" . __( 'Remove' ) . ""; + // Add a link to send the user a reset password link by email. + if ( get_current_user_id() != $user_object->ID && current_user_can( 'edit_user', $user_object->ID ) ) + $actions['resetpassword'] = "" . __( 'Send password reset' ) . ""; + /** * Filter the action links displayed under each user in the Users list table. * Index: src/wp-admin/js/user-profile.js =================================================================== --- src/wp-admin/js/user-profile.js (revisione 35561) +++ src/wp-admin/js/user-profile.js (copia locale) @@ -152,6 +152,64 @@ }); } + /** + * Handle the password reset button. Sets up an ajax callback to trigger sending + * a password reset email. + */ + function bindPasswordRestLink() { + $( '#generate-reset-link' ).on( 'click', function() { + var $this = $(this), + data = { + 'user_id': userProfileL10n.user_id, // The user to send a reset to. + 'nonce': userProfileL10n.nonce // Nonce to validate the action. + }, + // Send the reset request. + resetAction = wp.ajax.post( 'send-password-reset', data ); + + // Handle reset success. + resetAction.done( function( response ) { + addInlineNotice( $this, true, response ); + } ); + + // Handle reset failure. + resetAction.fail( function( response ) { + addInlineNotice( $this, false, response ); + } ); + + }); + + } + + /** + * Helper function to insert an inline notice of success or failure. + * + * @param {jQuery Object} $this The button element: the message will be inserted + * above this button + * @param {bool} success Whether the message is a success message. + * @param {string} message The message to insert. + */ + function addInlineNotice( $this, success, message ) { + var resultDiv = $( '
' ); + + // Set up the notice div. + resultDiv.addClass( 'notice inline' ); + + // Add a class indicating success or failure. + resultDiv.addClass( 'notice-' + ( success ? 'success' : 'error' ) ); + + // Add the message, using text for security, wrapping in a p tag. + resultDiv.text( message ).wrapInner( '

' ); + + // Disable the button when the callback has succeeded. + $this.prop( 'disabled', success ); + + // Remove any previous notices. + $this.siblings( '.notice' ).remove(); + + // Insert the notice. + $this.before( resultDiv ); + } + function bindPasswordForm() { var $passwordWrapper, $generateButton, @@ -380,6 +438,7 @@ }); bindPasswordForm(); + bindPasswordRestLink(); }); $( '#destroy-sessions' ).on( 'click', function( e ) { Index: src/wp-admin/user-edit.php =================================================================== --- src/wp-admin/user-edit.php (revisione 35561) +++ src/wp-admin/user-edit.php (copia locale) @@ -491,6 +491,27 @@ + + + + +

+ +
+

+ display_name ) ); + ?> +

+ + + get_all() ) === 1 ) : ?> Index: src/wp-admin/users.php =================================================================== --- src/wp-admin/users.php (revisione 35561) +++ src/wp-admin/users.php (copia locale) @@ -192,6 +192,50 @@ wp_redirect($redirect); exit(); +case 'resetpassword': + check_admin_referer('bulk-users'); + if ( ! current_user_can( 'edit_users' ) ) { + $errors = new WP_Error( 'edit_users', __( 'You can’t edit users.' ) ); + } + if ( empty( $_REQUEST['users'] ) ) { + wp_redirect( $redirect ); + exit(); + } + $userids = array_map( 'intval', (array) $_REQUEST['users'] ); + + $reset_count = 0; + + foreach ( $userids as $id ) { + if ( ! current_user_can( 'edit_user', $id ) ) + wp_die(__( 'You can’t edit that user.' ) ); + + if ( $id == $current_user->ID ) { + $update = 'err_admin_reset'; + continue; + } + + // Send the password reset. + $user = get_userdata( $id ); + + // Pass the username via $_POST. + $_POST['user_login'] = esc_attr( $user->user_login ); + + if ( retrieve_password() ) { + ++$reset_count; + } + + } + + $redirect = add_query_arg( + array( + 'reset_count' => $reset_count, + 'update' => 'resetpassword', + ), $redirect + ); + wp_redirect( $redirect ); + exit(); + + case 'delete': if ( is_multisite() ) wp_die( __('User deletion is not allowed from this screen.') ); @@ -429,6 +473,15 @@ $messages[] = '

' . __( 'New user created.' ) . '

'; } break; + case 'resetpassword': + $reset_count = isset( $_GET['reset_count'] ) ? (int) $_GET['reset_count'] : 0; + if ( 1 === $reset_count ) { + $message = __( 'Password reset link sent.' ); + } else { + $message = sprintf( __( 'Password reset links sent to %s users.' ), $reset_count ); + } + $messages[] = '

' . $message . '

'; + break; case 'promote': $messages[] = '

' . __('Changed roles.') . '

'; break; @@ -460,7 +513,6 @@
add('empty_username', __('ERROR: Enter a username or email address.')); + } elseif ( strpos( $_POST['user_login'], '@' ) ) { + $user_data = get_user_by( 'email', trim( $_POST['user_login'] ) ); + if ( empty( $user_data ) ) + $errors->add('invalid_email', __('ERROR: There is no user registered with that email address.')); + } else { + $login = trim($_POST['user_login']); + $user_data = get_user_by('login', $login); + } + + /** + * Fires before errors are returned from a password reset request. + * + * @since 2.1.0 + * @since 4.4.0 Added the `$errors` parameter. + * + * @param WP_Error $errors A WP_Error object containing any errors generated + * by using invalid credentials. + */ + do_action( 'lostpassword_post', $errors ); + + if ( $errors->get_error_code() ) + return $errors; + + if ( !$user_data ) { + $errors->add('invalidcombo', __('ERROR: Invalid username or email.')); + return $errors; + } + + // Redefining user_login ensures we return the right case in the email. + $user_login = $user_data->user_login; + $user_email = $user_data->user_email; + $key = get_password_reset_key( $user_data ); + + if ( is_wp_error( $key ) ) { + return $key; + } + + $message = __('Someone requested that the password be reset for the following account:') . "\r\n\r\n"; + $message .= network_home_url( '/' ) . "\r\n\r\n"; + $message .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n"; + $message .= __('If this was a mistake, just ignore this email and nothing will happen.') . "\r\n\r\n"; + $message .= __('To reset your password, visit the following address:') . "\r\n\r\n"; + $message .= '<' . network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . ">\r\n"; + + if ( is_multisite() ) + $blogname = $GLOBALS['current_site']->site_name; + else + /* + * The blogname option is escaped with esc_html on the way into the database + * in sanitize_option we want to reverse this for the plain text arena of emails. + */ + $blogname = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES); + + $title = sprintf( __('[%s] Password Reset'), $blogname ); + + /** + * Filter the subject of the password reset email. + * + * @since 2.8.0 + * @since 4.4.0 Added the `$user_login` and `$user_data` parameters. + * + * @param string $title Default email title. + * @param string $user_login The username for the user. + * @param WP_User $user_data WP_User object. + */ + $title = apply_filters( 'retrieve_password_title', $title, $user_login, $user_data ); + + /** + * Filter the message body of the password reset mail. + * + * @since 2.8.0 + * @since 4.1.0 Added `$user_login` and `$user_data` parameters. + * + * @param string $message Default mail message. + * @param string $key The activation key. + * @param string $user_login The username for the user. + * @param WP_User $user_data WP_User object. + */ + $message = apply_filters( 'retrieve_password_message', $message, $key, $user_login, $user_data ); + + if ( $message && !wp_mail( $user_email, wp_specialchars_decode( $title ), $message ) ) + wp_die( __('The email could not be sent.') . "
\n" . __('Possible reason: your host may have disabled the mail() function.') ); + + return true; +} Index: src/wp-includes/script-loader.php =================================================================== --- src/wp-includes/script-loader.php (revisione 35561) +++ src/wp-includes/script-loader.php (copia locale) @@ -382,6 +382,7 @@ 'mismatch' => _x( 'Mismatch', 'password mismatch' ), ) ); + $user_id = isset( $_GET['user_id'] ) ? (int) $_GET['user_id'] : 0; $scripts->add( 'user-profile', "/wp-admin/js/user-profile$suffix.js", array( 'jquery', 'password-strength-meter', 'wp-util' ), false, 1 ); did_action( 'init' ) && $scripts->localize( 'user-profile', 'userProfileL10n', array( 'warn' => __( 'Your new password has not been saved.' ), @@ -390,6 +391,8 @@ 'cancel' => __( 'Cancel' ), 'ariaShow' => esc_attr__( 'Show password' ), 'ariaHide' => esc_attr__( 'Hide password' ), + 'user_id' => $user_id, + 'nonce' => wp_create_nonce( 'reset-password-for-' . $user_id ), ) ); $scripts->add( 'language-chooser', "/wp-admin/js/language-chooser$suffix.js", array( 'jquery' ), false, 1 ); Index: src/wp-login.php =================================================================== --- src/wp-login.php (revisione 35561) +++ src/wp-login.php (copia locale) @@ -267,107 +267,6 @@ add('empty_username', __('ERROR: Enter a username or email address.')); - } elseif ( strpos( $_POST['user_login'], '@' ) ) { - $user_data = get_user_by( 'email', trim( $_POST['user_login'] ) ); - if ( empty( $user_data ) ) - $errors->add('invalid_email', __('ERROR: There is no user registered with that email address.')); - } else { - $login = trim($_POST['user_login']); - $user_data = get_user_by('login', $login); - } - - /** - * Fires before errors are returned from a password reset request. - * - * @since 2.1.0 - * @since 4.4.0 Added the `$errors` parameter. - * - * @param WP_Error $errors A WP_Error object containing any errors generated - * by using invalid credentials. - */ - do_action( 'lostpassword_post', $errors ); - - if ( $errors->get_error_code() ) - return $errors; - - if ( !$user_data ) { - $errors->add('invalidcombo', __('ERROR: Invalid username or email.')); - return $errors; - } - - // Redefining user_login ensures we return the right case in the email. - $user_login = $user_data->user_login; - $user_email = $user_data->user_email; - $key = get_password_reset_key( $user_data ); - - if ( is_wp_error( $key ) ) { - return $key; - } - - $message = __('Someone has requested a password reset for the following account:') . "\r\n\r\n"; - $message .= network_home_url( '/' ) . "\r\n\r\n"; - $message .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n"; - $message .= __('If this was a mistake, just ignore this email and nothing will happen.') . "\r\n\r\n"; - $message .= __('To reset your password, visit the following address:') . "\r\n\r\n"; - $message .= '<' . network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . ">\r\n"; - - if ( is_multisite() ) - $blogname = $GLOBALS['current_site']->site_name; - else - /* - * The blogname option is escaped with esc_html on the way into the database - * in sanitize_option we want to reverse this for the plain text arena of emails. - */ - $blogname = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES); - - $title = sprintf( __('[%s] Password Reset'), $blogname ); - - /** - * Filter the subject of the password reset email. - * - * @since 2.8.0 - * @since 4.4.0 Added the `$user_login` and `$user_data` parameters. - * - * @param string $title Default email title. - * @param string $user_login The username for the user. - * @param WP_User $user_data WP_User object. - */ - $title = apply_filters( 'retrieve_password_title', $title, $user_login, $user_data ); - - /** - * Filter the message body of the password reset mail. - * - * @since 2.8.0 - * @since 4.1.0 Added `$user_login` and `$user_data` parameters. - * - * @param string $message Default mail message. - * @param string $key The activation key. - * @param string $user_login The username for the user. - * @param WP_User $user_data WP_User object. - */ - $message = apply_filters( 'retrieve_password_message', $message, $key, $user_login, $user_data ); - - if ( $message && !wp_mail( $user_email, wp_specialchars_decode( $title ), $message ) ) - wp_die( __('The email could not be sent.') . "
\n" . __('Possible reason: your host may have disabled the mail() function.') ); - - return true; -} - // // Main //