Don't pass around the resetpass key

[nacin]

We should transfer it to a cookie instead and clear it when done.

[nacin]

In 29327:

Don't pass around the password reset key.

props mdawaffe.
fixes #29060.

[SergeyBiryukov]

Should we check if $_COOKIE[ $rp_cookie ] is set?

I see warnings if I visit wp-login.php?action=rp directly:

Notice: Undefined index: wp-resetpass-... in wp-login.php on line 571
Notice: Undefined offset: 1 in wp-login.php on line 571

Warning: Cannot modify header information - headers already sent by (output started at wp-login.php:571) in wp-login.php on line 576
Warning: Cannot modify header information - headers already sent by (output started at wp-login.php:571) in wp-includes\pluggable.php on line 1173

[mdawaffe]

Replying to SergeyBiryukov:

Should we check if $_COOKIE[ $rp_cookie ] is set?

We can get rid of the notices with attachment:29060.diff​. Care to test it out @SergeyBiryukov?

[SergeyBiryukov]

In 29381:

Avoid PHP notices in wp-login.php if password reset cookie is not set.

props mdawaffe.
see #29060.

[nacin]

In 29394:

Don't pass around the password reset key.

Merges [29327] and [29381] to the 3.9 branch.

props mdawaffe.
fixes #29060.

[nacin]

In 29395:

Don't pass around the password reset key.

Merges [29327] and [29381] to the 3.9 branch.

props mdawaffe.
fixes #29060.

[nacin]

In 29396:

Don't pass around the password reset key.

Merges [29327] and [29381] to the 3.7 branch.

props mdawaffe.
fixes #29060.

[jfarthing84]

@nacin I know I'm 2 years late to asking but can I get an explanation as to why this change was made?