auth cookies lose their correct expiration date when changing password

[Denis-de-Bernardy]

To reproduce:

1. Browse the site, and sign in with the remember me checkbox ticked
2. Visit your profile in the admin area, and change your password
3. Quit the browser (as in quit, rather than close the window, to ensure session cookies are cleared)
4. Re-open the browser, and browse the site

Expected: still logged in
Actual: logged out

[johnbillion]

Confirmed. Issue is here in wp_update_user(). The $remember parameter for wp_set_auth_cookie() isn't set.

Introduced in [6387].

Note: my User Switching plugin ​has a method for detecting whether the current user should be 'remembered' or not.

[johnbillion]

Actually, this was technically introduced way back in [2872].

[jesin]

Set the $remember boolean when calling wp_set_auth_cookie() inside wp_update_user()

[jesin]

I created this patch based on johnbillion's User Switching plugin.

Is the auth_cookie_expiration filter needed here? If it is required we again run into the problem of setting its $remember boolean.

[jesin]

Retrieve the cookie lifetime via auth_cookie_expiration filter

[jesin]

I understood that the auth_cookie_expiration filter is required, otherwise if the cookie lifetime was set to something more than 172800 a "Remember Me" cookie would be created when one changes their password !!!

However with this patch if the Non-Remember Me cookie's lifetime is set to something more than that of Remember Me's this bug appears.

Code to do that:

add_filter( 'auth_cookie_expiration', 'change_cookie_expiration_insanely', 10, 3);

function change_cookie_expiration_insanely( $time, $user_id, $remember ) {
        return ( $remember ? '3600' : '86400' );
}

But doing this achieves nothing other than modifying the Remember Me cookie's expires parameter, because WordPress sets $expire to 0 if $remember is false.

There is no other reliable way I could find for detecting if Remember Me was checked at login.

[DrewAPicture]

@johnbillion: what's left here?

[johnbillion]

In 29043:

Persist the "Remember Me" state of the auth cookie when changing your own password. Props jesin. Fixes #27627.

[johnbillion]

We could do with a cookie abstraction layer that we can mock in unit tests so we can test stuff like this.

[ocean90]

In 29102:

Add missing filter doc, see [29043].

see #27627.