← All changes
|
includes/forms/class-charitable-reset-password-form.php
+22
-7
1.6.9
→
1.8.13
View file →
| @@ -3,13 +3,15 @@ | ||
| 3 | 3 | * Class that manages the display and processing of the reset password form. |
| 4 | 4 | * |
| 5 | 5 | * @package Charitable/Classes/Charitable_Reset_Password_Form |
| 6 | 6 | * @version 1.5.1 |
| 7 | - * @author Rafe Colton, Eric Daams | |
| 8 | - * @copyright Copyright (c) 2019, Studio 164a | |
| 7 | + * @author Rafe Colton, David Bisset | |
| 8 | + * @copyright Copyright (c) 2023, WP Charitable LLC | |
| 9 | 9 | * @license http://opensource.org/licenses/gpl-2.0.php GNU Public License |
| 10 | 10 | */ |
| 11 | -if ( ! defined( 'ABSPATH' ) ) { exit; } | |
| 11 | +if ( ! defined( 'ABSPATH' ) ) { | |
| 12 | + exit; | |
| 13 | +} | |
| 12 | 14 | |
| 13 | 15 | if ( ! class_exists( 'Charitable_Reset_Password_Form' ) ) : |
| 14 | 16 | |
| 15 | 17 | /** |
| @@ -158,8 +160,9 @@ | ||
| 158 | 160 | /** |
| 159 | 161 | * Reset the password. |
| 160 | 162 | * |
| 161 | 163 | * @since 1.4.0 |
| 164 | + * @version 1.8.9.1 | |
| 162 | 165 | * |
| 163 | 166 | * @return bool|WP_Error True: when finish. WP_Error on error |
| 164 | 167 | */ |
| 165 | 168 | public static function reset_password() { |
| @@ -165,12 +168,13 @@ | ||
| 165 | 168 | public static function reset_password() { |
| 166 | 169 | $form = new Charitable_Reset_Password_Form(); |
| 167 | 170 | |
| 168 | 171 | if ( ! $form->validate_nonce() || ! $form->validate_honeypot() ) { |
| 169 | - charitable_get_notices()->add_error( __( 'There was an error with processing your form submission. Please reload the page and try again.', 'charitable' ) ); | |
| 172 | + charitable_get_notices()->add_error( __( 'Unfortunately, we were unable to verify your form submission. Please reload the page and try again.', 'charitable' ) ); | |
| 170 | 173 | return; |
| 171 | 174 | } |
| 172 | 175 | |
| 176 | + // phpcs:disable WordPress.Security.NonceVerification.Missing | |
| 173 | 177 | /* The key and login must be set. */ |
| 174 | 178 | if ( ! isset( $_POST['key'] ) || ! isset( $_POST['login'] ) ) { |
| 175 | 179 | charitable_get_notices()->add_error( '<strong>ERROR:</strong> Invalid reset key.', 'charitable' ); |
| 176 | 180 | return; |
| @@ -175,10 +179,13 @@ | ||
| 175 | 179 | charitable_get_notices()->add_error( '<strong>ERROR:</strong> Invalid reset key.', 'charitable' ); |
| 176 | 180 | return; |
| 177 | 181 | } |
| 178 | 182 | |
| 179 | - $user = check_password_reset_key( $_POST['key'], $_POST['login'] ); | |
| 183 | + $key = sanitize_text_field( wp_unslash( $_POST['key'] ) ); | |
| 184 | + $login = sanitize_text_field( wp_unslash( $_POST['login'] ) ); | |
| 180 | 185 | |
| 186 | + $user = check_password_reset_key( $key, $login ); | |
| 187 | + | |
| 181 | 188 | if ( is_wp_error( $user ) ) { |
| 182 | 189 | charitable_get_notices()->add_errors_from_wp_error( $user ); |
| 183 | 190 | return; |
| 184 | 191 | } |
| @@ -188,16 +195,22 @@ | ||
| 188 | 195 | charitable_get_notices()->add_error( '<strong>ERROR:</strong> You must enter both passwords.', 'charitable' ); |
| 189 | 196 | return; |
| 190 | 197 | } |
| 191 | 198 | |
| 199 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Password fields should not be sanitized | |
| 200 | + $pass1 = wp_unslash( $_POST['pass1'] ); | |
| 201 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Password fields should not be sanitized | |
| 202 | + $pass2 = wp_unslash( $_POST['pass2'] ); | |
| 203 | + | |
| 192 | 204 | /* The passwords do not match. */ |
| 193 | - if ( $_POST['pass1'] != $_POST['pass2'] ) { | |
| 205 | + if ( $pass1 != $pass2 ) { | |
| 194 | 206 | charitable_get_notices()->add_error( __( '<strong>ERROR:</strong> The two passwords you entered don\'t match.', 'charitable' ) ); |
| 195 | 207 | return; |
| 196 | 208 | } |
| 197 | 209 | |
| 198 | 210 | /* Parameter checks OK, reset password */ |
| 199 | - reset_password( $user, $_POST['pass1'] ); | |
| 211 | + reset_password( $user, $pass1 ); | |
| 212 | + // phpcs:enable WordPress.Security.NonceVerification.Missing | |
| 200 | 213 | |
| 201 | 214 | charitable_get_notices()->add_success( __( 'Your password was successfully changed.', 'charitable' ) ); |
| 202 | 215 | |
| 203 | 216 | charitable_get_session()->add_notices(); |
| @@ -211,8 +224,9 @@ | ||
| 211 | 224 | * Get the reset key and login from the cookie. |
| 212 | 225 | * |
| 213 | 226 | * @since 1.4.0 |
| 214 | 227 | * @since 1.5.0 Returns a boolean to indicate whether the key and login are available. |
| 228 | + * @version 1.8.9.1 | |
| 215 | 229 | * |
| 216 | 230 | * @return boolean True if the reset key is found. False otherwise. |
| 217 | 231 | */ |
| 218 | 232 | protected function parse_reset_key() { |
| @@ -223,8 +237,9 @@ | ||
| 223 | 237 | charitable_get_notices()->add_error( __( 'Missing password reset key.', 'charitable' ) ); |
| 224 | 238 | return false; |
| 225 | 239 | } |
| 226 | 240 | |
| 241 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash | |
| 227 | 242 | $cookie = $_COOKIE[ 'wp-resetpass-' . COOKIEHASH ]; |
| 228 | 243 | |
| 229 | 244 | if ( ! strpos( $cookie, ':' ) ) { |
| 230 | 245 | charitable_get_notices()->add_error( __( 'Missing password reset key.', 'charitable' ) ); |