Password reset form fails when email address includes apostrophes.

[dcavins]

If a user's email address contains an apostrophe, the get_user_by() lookup fails because it's checking an email address that's been slashed to travel via $_POST. The conservative fix (patch attached) is to add wp_unslash to retrieve_password(), which is in the spirit of a related fix for adding users via the dashboard, r29966.

I also wonder about adding wp_unslash() to get_user_by( 'email' ) generally so that this problem is fixed everywhere, but the unintended consequences of that change could be bigger than I imagine.

Thanks!

[dcavins]

Un-slash posted email addresses before attempting get_user_by.

[johnbillion]

Thanks for the patch!

[adamsilverstein]

Good catch @dcavins! A unit test validating the issue and fix would be helpful here.

[dcavins]

I'd love to write a unit test for this, but I can't figure out how to load wp-login.php at the time of the test. The function I'm testing, retrieve_password(), isn't normally available. @boonebgorges suggests that it may not be possible to test this function given the current testing setup.

[johnbillion]

Yeah this is probably untestable given the current state of wp-login.php.

[gitlost]

Unit test loading just the PHP functions.

[gitlost]

There's a unit test that uses an eval() to load just the PHP functions in "wp-login.php".

[johnbillion]

Related: #34297

[boonebgorges]

@gitlost Thank you for your heroic efforts at making wp-login testable. However, I think we would be far better served by (a) moving login-related functions to a different file (see #35829 and friends), and (b) adopting a proper system for browsers tests (see #34693). The current fix is simple enough that we'll forgo the tests.

[boonebgorges]

In 37474:

During password reset, user-submitted login/email should be stripslashed.

This prevents errors when an email address contains an apostrophe. See [29966]
for similar treatment of a related problem.

Props dcavins.
Fixes #36322.