WordPress Version: 5.2
/**
* Retrieves a user row based on password reset key and login
*
* A key is considered 'expired' if it exactly matches the value of the
* user_activation_key field, rather than being matched after going through the
* hashing process. This field is now hashed; old values are no longer accepted
* but have a different WP_Error code so good user feedback can be provided.
*
* @since 3.1.0
*
* @global wpdb $wpdb WordPress database object for queries.
* @global PasswordHash $wp_hasher Portable PHP password hashing framework instance.
*
* @param string $key Hash to validate sending user's password.
* @param string $login The user login.
* @return WP_User|WP_Error WP_User object on success, WP_Error object for invalid or expired keys.
*/
function check_password_reset_key($key, $login)
{
global $wpdb, $wp_hasher;
$key = preg_replace('/[^a-z0-9]/i', '', $key);
if (empty($key) || !is_string($key)) {
return new WP_Error('invalid_key', __('Invalid key.'));
}
if (empty($login) || !is_string($login)) {
return new WP_Error('invalid_key', __('Invalid key.'));
}
$row = $wpdb->get_row($wpdb->prepare("SELECT ID, user_activation_key FROM {$wpdb->users} WHERE user_login = %s", $login));
if (!$row) {
return new WP_Error('invalid_key', __('Invalid key.'));
}
if (empty($wp_hasher)) {
require_once ABSPATH . WPINC . '/class-phpass.php';
$wp_hasher = new PasswordHash(8, true);
}
/**
* Filters the expiration time of password reset keys.
*
* @since 4.3.0
*
* @param int $expiration The expiration time in seconds.
*/
$expiration_duration = apply_filters('password_reset_expiration', DAY_IN_SECONDS);
if (false !== strpos($row->user_activation_key, ':')) {
list($pass_request_time, $pass_key) = explode(':', $row->user_activation_key, 2);
$expiration_time = $pass_request_time + $expiration_duration;
} else {
$pass_key = $row->user_activation_key;
$expiration_time = false;
}
if (!$pass_key) {
return new WP_Error('invalid_key', __('Invalid key.'));
}
$hash_is_correct = $wp_hasher->CheckPassword($key, $pass_key);
if ($hash_is_correct && $expiration_time && time() < $expiration_time) {
return get_userdata($row->ID);
} elseif ($hash_is_correct && $expiration_time) {
// Key has an expiration time that's passed
return new WP_Error('expired_key', __('Invalid key.'));
}
if (hash_equals($row->user_activation_key, $key) || $hash_is_correct && !$expiration_time) {
$return = new WP_Error('expired_key', __('Invalid key.'));
$user_id = $row->ID;
/**
* Filters the return value of check_password_reset_key() when an
* old-style key is used.
*
* @since 3.7.0 Previously plain-text keys were stored in the database.
* @since 4.3.0 Previously key hashes were stored without an expiration time.
*
* @param WP_Error $return A WP_Error object denoting an expired key.
* Return a WP_User object to validate the key.
* @param int $user_id The matched user ID.
*/
return apply_filters('password_reset_key_expired', $return, $user_id);
}
return new WP_Error('invalid_key', __('Invalid key.'));
}