diff -ur wordpress-582-orig/wp-admin/includes/class-wp-users-list-table.php wordpress/wp-admin/includes/class-wp-users-list-table.php
--- wordpress-582-orig/wp-admin/includes/class-wp-users-list-table.php 2021-06-08 17:21:57.000000000 -0500
+++ wordpress/wp-admin/includes/class-wp-users-list-table.php 2021-11-23 11:25:41.881266000 -0600
@@ -476,7 +476,7 @@
}
// Add a link to send the user a reset password link by email.
- if ( get_current_user_id() !== $user_object->ID && current_user_can( 'edit_user', $user_object->ID ) ) {
+ if ( get_current_user_id() !== $user_object->ID && current_user_can( 'edit_user', $user_object->ID ) && is_password_reset_allowed( $user_object->ID ) ) {
$actions['resetpassword'] = "" . __( 'Send password reset' ) . '';
}
diff -ur wordpress-582-orig/wp-admin/user-edit.php wordpress/wp-admin/user-edit.php
--- wordpress-582-orig/wp-admin/user-edit.php 2021-06-07 18:49:58.000000000 -0500
+++ wordpress/wp-admin/user-edit.php 2021-11-23 11:28:22.566202900 -0600
@@ -672,7 +672,7 @@
ID ) ) :
?>
|
diff -ur wordpress-582-orig/wp-includes/user.php wordpress/wp-includes/user.php
--- wordpress-582-orig/wp-includes/user.php 2021-07-12 19:07:59.000000000 -0500
+++ wordpress/wp-includes/user.php 2021-11-23 11:15:14.813439300 -0600
@@ -2501,6 +2501,31 @@
return apply_filters( 'password_hint', $hint );
}
+/** Returns whether to allow a password to be reset.
+ *
+ * @since 6.0.0
+ *
+ * @param WP_User $user User to retrieve password reset key for.
+ * @return bool True if password reset is allowed, false if not allowed.
+ */
+function is_password_reset_allowed( $user ) {
+ $allow = true;
+ if ( is_multisite() && is_user_spammy( $user ) ) {
+ $allow = false;
+ }
+
+ /**
+ * Filters whether to allow a password to be reset.
+ *
+ * @since 2.7.0
+ *
+ * @param bool $allow Whether to allow the password to be reset. Default true.
+ * @param int $ID The ID of the user attempting to reset a password.
+ */
+ $allow = apply_filters( 'allow_password_reset', $allow, $user->ID );
+ return $allow;
+}
+
/**
* Creates, stores, then returns a password reset key for user.
*
@@ -2539,25 +2564,8 @@
*/
do_action( 'retrieve_password', $user->user_login );
- $allow = true;
- if ( is_multisite() && is_user_spammy( $user ) ) {
- $allow = false;
- }
-
- /**
- * Filters whether to allow a password to be reset.
- *
- * @since 2.7.0
- *
- * @param bool $allow Whether to allow the password to be reset. Default true.
- * @param int $ID The ID of the user attempting to reset a password.
- */
- $allow = apply_filters( 'allow_password_reset', $allow, $user->ID );
-
- if ( ! $allow ) {
+ if ( ! is_password_reset_allowed( $user ) ) {
return new WP_Error( 'no_password_reset', __( 'Password reset is not allowed for this user' ) );
- } elseif ( is_wp_error( $allow ) ) {
- return $allow;
}
// Generate something random for a password reset key.