Index: src/wp-includes/class-wp-recovery-mode-email-service.php =================================================================== --- src/wp-includes/class-wp-recovery-mode-email-service.php (revision 45506) +++ src/wp-includes/class-wp-recovery-mode-email-service.php (working copy) @@ -24,6 +24,13 @@ private $link_service; /** + * + * @since 5.3.0 + * @var string + */ + private $recovery_mode_email_address; + + /** * WP_Recovery_Mode_Email_Service constructor. * * @since 5.2.0 @@ -32,6 +39,7 @@ */ public function __construct( WP_Recovery_Mode_Link_Service $link_service ) { $this->link_service = $link_service; + $this->setup_recovery_mode_email_address(); } /** @@ -47,7 +55,7 @@ * } * @return true|WP_Error True if email sent, WP_Error otherwise. */ - public function maybe_send_recovery_mode_email( $rate_limit, $error, $extension ) { + public function maybe_send_recovery_mode_email( $rate_limit = 0, $error = array(), $extension = array(0) ) { $last_sent = get_option( self::RATE_LIMIT_OPTION ); @@ -210,19 +218,16 @@ return $sent; } + /** - * Gets the email address to send the recovery mode link to. * - * @since 5.2.0 - * - * @return string Email address to send recovery mode link to. */ - private function get_recovery_mode_email_address() { + private function setup_recovery_mode_email_address() { if ( defined( 'RECOVERY_MODE_EMAIL' ) && is_email( RECOVERY_MODE_EMAIL ) ) { - return RECOVERY_MODE_EMAIL; + $this->recovery_mode_email_address = RECOVERY_MODE_EMAIL; } - return get_option( 'admin_email' ); + $this->recovery_mode_email_address = get_option( 'admin_email' ); } /** @@ -272,4 +277,24 @@ return $cause; } + + /** + * Gets the email address to send the recovery mode link to. + * + * @since 5.2.0 + * + * @return string Email address to send recovery mode link to. + */ + private function get_recovery_mode_email_address() { + return $this->recovery_mode_email_address; + } + + /** + * @param string $recovery_mode_email_address + */ + public function set_recovery_mode_email_address( $recovery_mode_email_address ) { + $this->recovery_mode_email_address = $recovery_mode_email_address; + } + + } Index: src/wp-includes/class-wp-recovery-mode.php =================================================================== --- src/wp-includes/class-wp-recovery-mode.php (revision 45506) +++ src/wp-includes/class-wp-recovery-mode.php (working copy) @@ -10,6 +10,7 @@ * Core class used to implement Recovery Mode. * * @since 5.2.0 + * */ class WP_Recovery_Mode { @@ -464,4 +465,11 @@ wp_safe_redirect( $url ); exit; } + + /** + * @return WP_Recovery_Mode_Email_Service + */ + public function get_email_service() { + return $this->email_service; + } } Index: src/wp-login.php =================================================================== --- src/wp-login.php (revision 45506) +++ src/wp-login.php (working copy) @@ -8,6 +8,13 @@ * @package WordPress */ +$action_check = isset( $_REQUEST['action'] ) ? $_REQUEST['action'] : 'login'; +$recovery_actions = array( 'recovery_request', 'recovery_recieved' ); +if ( in_array( $action_check, $recovery_actions, true ) && ! defined( 'WP_RECOVERY_MODE_SESSION_ID' ) ) { + define( 'WP_RECOVERY_MODE_SESSION_ID', '1123456' ); +} + + /** Make sure that the WordPress bootstrap has run before continuing. */ require( dirname( __FILE__ ) . '/wp-load.php' ); @@ -25,6 +32,7 @@ /** * Output the login page header. * + * * @since 2.1.0 * * @param string $title Optional. WordPress login Page title to display in the `` element. @@ -187,6 +195,7 @@ ?> </head> <body class="login <?php echo esc_attr( implode( ' ', $classes ) ); ?>"> + <?php /** * Fires in the login page header after the body tag is opened. @@ -441,6 +450,56 @@ return true; } +/** + * Handles sending recovery_link retrieval email to user. + * + * @since 5.3.0 + * + * @return bool|WP_Error True: when finish. WP_Error on error + */ +function retrieve_recovery_link() { + $errors = new WP_Error(); + + if ( empty( $_POST['user_login'] ) || ! is_string( $_POST['user_login'] ) ) { + $errors->add( 'empty_username', __( '<strong>ERROR</strong>: Enter a username or email address.' ) ); + $user_data = false; + } elseif ( is_email( $_POST['user_login']) ) { + $user_data = get_user_by( 'email', trim( wp_unslash( $_POST['user_login'] ) ) ); + if ( empty( $user_data ) ) { + $errors->add( 'invalid_email', __( '<strong>ERROR</strong>: There is no account with that username or email address.' ) ); + } + } else { + $login = trim( $_POST['user_login'] ); + $user_data = get_user_by( 'login', $login ); + } + + if ( $errors->has_errors() ) { + return $errors; + } + + if ( ! $user_data ) { + $errors->add( 'invalidcombo', __( '<strong>ERROR</strong>: There is no account with that username or email address.' ) ); + + return $errors; + } + + if ( ! user_can( $user_data, 'resume_plugins' ) && user_can( $user_data, 'resume_themes' ) ) { + $errors->add( 'invaliduser', __( '<strong>ERROR</strong>: This account is unable to access recovery mode.' ) ); + + return $errors; + } + + wp_recovery_mode()->get_email_service()->set_recovery_mode_email_address( $user_data->user_email ); + $email_sent = wp_recovery_mode()->get_email_service()->send_recovery_mode_email( 0, array(), array() ); + + if ( ! $email_sent ) { + $errors->add( 'unable_to_send', __( '<strong>ERROR</strong>: Unable to send email.' ) ); + return $email_sent; + } + + return true; +} + // // Main. // @@ -453,7 +512,7 @@ } // Validate action so as to default to the login screen. -if ( ! in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'confirmaction', WP_Recovery_Mode_Link_Service::LOGIN_ACTION_ENTERED ), true ) && false === has_filter( 'login_form_' . $action ) ) { +if ( ! in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'confirmaction', 'recovery_request', 'recovery_recieved', WP_Recovery_Mode_Link_Service::LOGIN_ACTION_ENTERED ), true ) && false === has_filter( 'login_form_' . $action ) ) { $action = 'login'; } @@ -654,7 +713,89 @@ login_footer( 'user_login' ); break; + case 'recovery_recieved': + if ( is_multisite() ) { + $page_title = __( 'User action disabled.' ); + $message = '<p class="message">' . __( 'Recovery mode not supported in multiste.' ) . '</p>'; + } else{ + $page_title = __( 'User action confirmed.' ); + $message = '<p class="message">' . __( 'Check your email for the recovery link.' ) . '</p>'; + } + + login_header( $page_title, $message ); + login_footer(); + exit; + + case 'recovery_request': + if ( is_multisite() ) { + $page_title = __( 'User action disabled.' ); + $message = '<p class="message">' . __( 'Recovery mode not supported in multiste.' ) . '</p>'; + + login_header( $page_title, $message ); + login_footer(); + exit; + } + if ( $http_post ) { + $errors = retrieve_recovery_link(); + if ( ! is_wp_error( $errors ) ) { + $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : 'wp-login.php?action=recovery_recieved'; + wp_safe_redirect( $redirect_to ); + exit(); + } + } + + $recovery_request_redirect = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : ''; + /** + * Filters the URL redirected to after submitting the recovery_request form. + * + * @since 5.3.0 + * + * @param string $recovery_request The redirect destination URL. + */ + $redirect_to = apply_filters( 'recovery_request_redirect', $recovery_request_redirect ); + + + + login_header( __( 'Request recovery ink' ), '<p class="message">' . __( 'Please enter your username or email address. You will receive a recovery link via email.' ) . '</p>', $errors ); + + $user_login = ''; + + if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) { + $user_login = wp_unslash( $_POST['user_login'] ); + } + + ?> + + <form name="recovery_request" id="recovery_request" action="<?php echo esc_url( site_url( 'wp-login.php?action=recovery_request', 'recovery_request' ) ); ?>" method="post"> + <p> + <label for="user_login" ><?php _e( 'Username or Email Address' ); ?><br /> + <input type="text" name="user_login" id="user_login" class="input" value="<?php echo esc_attr( $user_login ); ?>" size="20" autocapitalize="off" /></label> + </p> + <input type="hidden" name="redirect_to" value="<?php echo esc_attr( $redirect_to ); ?>" /> + <p class="submit"><input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e( 'Request recovery email' ); ?>" /></p> + </form> + + <p id="nav"> + <a href="<?php echo esc_url( wp_login_url() ); ?>"><?php _e( 'Log in' ); ?></a> + <?php + if ( get_option( 'users_can_register' ) ) : + $registration_url = sprintf( '<a href="%s">%s</a>', esc_url( wp_registration_url() ), __( 'Register' ) ); + + echo esc_html( $login_link_separator ); + + /** This filter is documented in wp-includes/general-template.php */ + echo apply_filters( 'register', $registration_url ); + endif; + ?> + </p> + + <?php + login_footer( 'user_login' ); + + break; + + case 'resetpass': case 'rp': list( $rp_path ) = explode( '?', wp_unslash( $_SERVER['REQUEST_URI'] ) );