← All changes
|
includes/forms/class-charitable-forgot-password-form.php
+23
-16
1.7.0.12
→
1.8.13
View file →
| @@ -3,9 +3,9 @@ | ||
| 3 | 3 | * Class that manages the display and processing of the forgot password form. |
| 4 | 4 | * |
| 5 | 5 | * @package Charitable/Classes/Charitable_Forgot_Password_Form |
| 6 | 6 | * @author Rafe Colton, David Bisset |
| 7 | - * @copyright Copyright (c) 2022, WP Charitable LLC | |
| 7 | + * @copyright Copyright (c) 2023, WP Charitable LLC | |
| 8 | 8 | * @license http://opensource.org/licenses/gpl-2.0.php GNU Public License |
| 9 | 9 | * @since 1.4.0 |
| 10 | 10 | * @version 1.5.1 |
| 11 | 11 | */ |
| @@ -53,10 +53,8 @@ | ||
| 53 | 53 | /** |
| 54 | 54 | * Create class object. |
| 55 | 55 | * |
| 56 | 56 | * @since 1.4.0 |
| 57 | - * | |
| 58 | - * @param array $args User-defined shortcode attributes. | |
| 59 | 57 | */ |
| 60 | 58 | public function __construct() { |
| 61 | 59 | $this->id = uniqid(); |
| 62 | 60 | |
| @@ -71,16 +69,19 @@ | ||
| 71 | 69 | * |
| 72 | 70 | * @return array |
| 73 | 71 | */ |
| 74 | 72 | public function get_fields() { |
| 75 | - $fields = apply_filters( 'charitable_forgot_password_fields', array( | |
| 76 | - 'user_login' => array( | |
| 77 | - 'label' => __( 'Email Address', 'charitable' ), | |
| 78 | - 'type' => 'email', | |
| 79 | - 'required' => true, | |
| 80 | - 'priority' => 10, | |
| 81 | - ), | |
| 82 | - ) ); | |
| 73 | + $fields = apply_filters( | |
| 74 | + 'charitable_forgot_password_fields', | |
| 75 | + array( | |
| 76 | + 'user_login' => array( | |
| 77 | + 'label' => __( 'Email Address', 'charitable' ), | |
| 78 | + 'type' => 'email', | |
| 79 | + 'required' => true, | |
| 80 | + 'priority' => 10, | |
| 81 | + ), | |
| 82 | + ) | |
| 83 | + ); | |
| 83 | 84 | |
| 84 | 85 | uasort( $fields, 'charitable_priority_sort' ); |
| 85 | 86 | |
| 86 | 87 | return $fields; |
| @@ -100,18 +101,24 @@ | ||
| 100 | 101 | charitable_get_notices()->add_error( __( 'Unfortunately, we were unable to verify your form submission. Please reload the page and try again.', 'charitable' ) ); |
| 101 | 102 | return; |
| 102 | 103 | } |
| 103 | 104 | |
| 104 | - if ( empty( $_POST['user_login'] ) ) { | |
| 105 | + if ( empty( $_POST['user_login'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing | |
| 105 | 106 | charitable_get_notices()->add_error( __( '<strong>ERROR</strong>: Enter a username or email address.', 'charitable' ) ); |
| 106 | 107 | return; |
| 107 | - } elseif ( strpos( $_POST['user_login'], '@' ) ) { | |
| 108 | - $user = get_user_by( 'email', trim( $_POST['user_login'] ) ); | |
| 108 | + } | |
| 109 | + | |
| 110 | + /* Sanitize and unslash the user input. */ | |
| 111 | + $user_login = sanitize_text_field( wp_unslash( $_POST['user_login'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing | |
| 112 | + | |
| 113 | + if ( strpos( $user_login, '@' ) ) { | |
| 114 | + $user = get_user_by( 'email', trim( $user_login ) ); | |
| 109 | 115 | } else { |
| 110 | - $login = trim( $_POST['user_login'] ); | |
| 111 | - $user = get_user_by( 'login', $login ); | |
| 116 | + $login = trim( $user_login ); | |
| 117 | + $user = get_user_by( 'login', $login ); | |
| 112 | 118 | } |
| 113 | 119 | |
| 120 | + // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- lostpassword_post is a WordPress core hook for password reset functionality. | |
| 114 | 121 | do_action( 'lostpassword_post' ); |
| 115 | 122 | |
| 116 | 123 | /* If we are missing user data, proceed no further. */ |
| 117 | 124 | if ( ! $user ) { |