← All changes
|
includes/forms/class-charitable-reset-password-form.php
+17
-4
1.7.0.7
→
1.8.13
View file →
| @@ -4,9 +4,9 @@ | ||
| 4 | 4 | * |
| 5 | 5 | * @package Charitable/Classes/Charitable_Reset_Password_Form |
| 6 | 6 | * @version 1.5.1 |
| 7 | 7 | * @author Rafe Colton, David Bisset |
| 8 | - * @copyright Copyright (c) 2022, WP Charitable LLC | |
| 8 | + * @copyright Copyright (c) 2023, WP Charitable LLC | |
| 9 | 9 | * @license http://opensource.org/licenses/gpl-2.0.php GNU Public License |
| 10 | 10 | */ |
| 11 | 11 | if ( ! defined( 'ABSPATH' ) ) { |
| 12 | 12 | exit; |
| @@ -160,8 +160,9 @@ | ||
| 160 | 160 | /** |
| 161 | 161 | * Reset the password. |
| 162 | 162 | * |
| 163 | 163 | * @since 1.4.0 |
| 164 | + * @version 1.8.9.1 | |
| 164 | 165 | * |
| 165 | 166 | * @return bool|WP_Error True: when finish. WP_Error on error |
| 166 | 167 | */ |
| 167 | 168 | public static function reset_password() { |
| @@ -171,8 +172,9 @@ | ||
| 171 | 172 | charitable_get_notices()->add_error( __( 'Unfortunately, we were unable to verify your form submission. Please reload the page and try again.', 'charitable' ) ); |
| 172 | 173 | return; |
| 173 | 174 | } |
| 174 | 175 | |
| 176 | + // phpcs:disable WordPress.Security.NonceVerification.Missing | |
| 175 | 177 | /* The key and login must be set. */ |
| 176 | 178 | if ( ! isset( $_POST['key'] ) || ! isset( $_POST['login'] ) ) { |
| 177 | 179 | charitable_get_notices()->add_error( '<strong>ERROR:</strong> Invalid reset key.', 'charitable' ); |
| 178 | 180 | return; |
| @@ -177,10 +179,13 @@ | ||
| 177 | 179 | charitable_get_notices()->add_error( '<strong>ERROR:</strong> Invalid reset key.', 'charitable' ); |
| 178 | 180 | return; |
| 179 | 181 | } |
| 180 | 182 | |
| 181 | - $user = check_password_reset_key( $_POST['key'], $_POST['login'] ); | |
| 183 | + $key = sanitize_text_field( wp_unslash( $_POST['key'] ) ); | |
| 184 | + $login = sanitize_text_field( wp_unslash( $_POST['login'] ) ); | |
| 182 | 185 | |
| 186 | + $user = check_password_reset_key( $key, $login ); | |
| 187 | + | |
| 183 | 188 | if ( is_wp_error( $user ) ) { |
| 184 | 189 | charitable_get_notices()->add_errors_from_wp_error( $user ); |
| 185 | 190 | return; |
| 186 | 191 | } |
| @@ -190,16 +195,22 @@ | ||
| 190 | 195 | charitable_get_notices()->add_error( '<strong>ERROR:</strong> You must enter both passwords.', 'charitable' ); |
| 191 | 196 | return; |
| 192 | 197 | } |
| 193 | 198 | |
| 199 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Password fields should not be sanitized | |
| 200 | + $pass1 = wp_unslash( $_POST['pass1'] ); | |
| 201 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Password fields should not be sanitized | |
| 202 | + $pass2 = wp_unslash( $_POST['pass2'] ); | |
| 203 | + | |
| 194 | 204 | /* The passwords do not match. */ |
| 195 | - if ( $_POST['pass1'] != $_POST['pass2'] ) { | |
| 205 | + if ( $pass1 != $pass2 ) { | |
| 196 | 206 | charitable_get_notices()->add_error( __( '<strong>ERROR:</strong> The two passwords you entered don\'t match.', 'charitable' ) ); |
| 197 | 207 | return; |
| 198 | 208 | } |
| 199 | 209 | |
| 200 | 210 | /* Parameter checks OK, reset password */ |
| 201 | - reset_password( $user, $_POST['pass1'] ); | |
| 211 | + reset_password( $user, $pass1 ); | |
| 212 | + // phpcs:enable WordPress.Security.NonceVerification.Missing | |
| 202 | 213 | |
| 203 | 214 | charitable_get_notices()->add_success( __( 'Your password was successfully changed.', 'charitable' ) ); |
| 204 | 215 | |
| 205 | 216 | charitable_get_session()->add_notices(); |
| @@ -213,8 +224,9 @@ | ||
| 213 | 224 | * Get the reset key and login from the cookie. |
| 214 | 225 | * |
| 215 | 226 | * @since 1.4.0 |
| 216 | 227 | * @since 1.5.0 Returns a boolean to indicate whether the key and login are available. |
| 228 | + * @version 1.8.9.1 | |
| 217 | 229 | * |
| 218 | 230 | * @return boolean True if the reset key is found. False otherwise. |
| 219 | 231 | */ |
| 220 | 232 | protected function parse_reset_key() { |
| @@ -225,8 +237,9 @@ | ||
| 225 | 237 | charitable_get_notices()->add_error( __( 'Missing password reset key.', 'charitable' ) ); |
| 226 | 238 | return false; |
| 227 | 239 | } |
| 228 | 240 | |
| 241 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash | |
| 229 | 242 | $cookie = $_COOKIE[ 'wp-resetpass-' . COOKIEHASH ]; |
| 230 | 243 | |
| 231 | 244 | if ( ! strpos( $cookie, ':' ) ) { |
| 232 | 245 | charitable_get_notices()->add_error( __( 'Missing password reset key.', 'charitable' ) ); |