Invalid return statement when request status is checked

[moikano]

Currently in wp_validate_user_request_key(), when controls the status of request, it return a string instead a WP_Error object ( https://core.trac.wordpress.org/browser/tags/4.9.7/src/wp-includes/user.php#L3393 ).

I don't know if the message is correct too.

Now it is:

if ( ! in_array( $request->status, array( 'request-pending', 'request-failed' ), true ) ) {
        return __( 'This link has expired.' );
}

I think it would be something like:

if ( ! in_array( $request->status, array( 'request-pending', 'request-failed' ), true ) ) {
        return new WP_Error( 'user_request_error', __( 'Invalid request.' ) );
}

I think It is important because this function return bool true when all is correct and a string it is also true (if not strict checked).

[subrataemfluence]

Hi moikano! Welcome to Trac and thank you for raising the ticket.

You have pointed out correctly. Since the return type of the function is either bool or WP_Error, anything returned from this function should not be a string!

[subrataemfluence]

Proposed patch

[SergeyBiryukov]

Hi @moikano, welcome to WordPress Trac!

Thanks for the report, we're already tracking this issue in #44685.