| @@ -173,14 +173,10 @@ | ||
| 173 | 173 | * @return void |
| 174 | 174 | * @since 2.8.0 |
| 175 | 175 | */ |
| 176 | 176 | public function before_mask_login_handle(): void { |
| 177 | - // Some plugins for Cron actions clear HTTP_HOST-param. | |
| 178 | - $host = defender_get_data_from_request( 'HTTP_HOST', 's' ); | |
| 179 | - if ( ! isset( $host['HTTP_HOST'] ) ) { | |
| 180 | - $host = ''; | |
| 181 | - } | |
| 182 | - $current_url = set_url_scheme( 'http://' . $host . defender_get_data_from_request( 'REQUEST_URI', 's' ) ); | |
| 177 | + $request_uri = (string) defender_get_data_from_request( 'REQUEST_URI', 's' ); | |
| 178 | + $current_url = home_url( $request_uri ); | |
| 183 | 179 | $login_url = $this->get_model()->get_new_login_url( $this->get_site_url() ); |
| 184 | 180 | |
| 185 | 181 | if ( |
| 186 | 182 | ! is_user_logged_in() && |
| @@ -879,8 +875,12 @@ | ||
| 879 | 875 | $action = defender_get_data_from_request( 'action', 'g' ); |
| 880 | 876 | $key = wp_unslash( defender_get_data_from_request( 'key', 'r' ) ); |
| 881 | 877 | $login = wp_unslash( defender_get_data_from_request( 'login', 'r' ) ); |
| 882 | 878 | $wd_ml_token = defender_get_data_from_request( 'wd-ml-token', 'g' ); |
| 879 | + $cookie_name = 'wd-rp-' . COOKIEHASH; | |
| 880 | + $rp_path = defined( 'COOKIEPATH' ) ? COOKIEPATH : '/'; | |
| 881 | + $rp_domain = defined( 'COOKIE_DOMAIN' ) ? COOKIE_DOMAIN : ''; | |
| 882 | + | |
| 883 | 883 | if ( |
| 884 | 884 | isset( $action, $key, $login, $wd_ml_token ) |
| 885 | 885 | && 'rp' === $action |
| 886 | 886 | && $login === $wd_ml_token |
| @@ -887,35 +887,59 @@ | ||
| 887 | 887 | ) { |
| 888 | 888 | |
| 889 | 889 | $user = check_password_reset_key( $key, $login ); |
| 890 | 890 | if ( ! is_wp_error( $user ) ) { |
| 891 | - $value = sprintf( '%s:%s', $login, $key ); | |
| 892 | - set_site_transient( 'wd-rp-' . COOKIEHASH, $value, 2 * MINUTE_IN_SECONDS ); | |
| 891 | + $token = wp_generate_password( 20, false ); | |
| 892 | + $transient_key = 'wd-rp-' . COOKIEHASH . '_' . $token; | |
| 893 | + $value = sprintf( '%s:%s', $login, $key ); | |
| 894 | + | |
| 895 | + set_site_transient( $transient_key, $value, 2 * MINUTE_IN_SECONDS ); | |
| 896 | + setcookie( $cookie_name, $token, 0, $rp_path, $rp_domain, is_ssl(), true ); | |
| 897 | + $_COOKIE[ $cookie_name ] = $token; | |
| 898 | + | |
| 893 | 899 | wp_safe_redirect( remove_query_arg( array( 'key', 'login', 'wd-ml-token' ) ) ); |
| 894 | 900 | exit; |
| 895 | 901 | } |
| 896 | 902 | } |
| 897 | - $value = get_site_transient( 'wd-rp-' . COOKIEHASH ); | |
| 903 | + | |
| 904 | + $cookie_token = defender_get_data_from_request( $cookie_name, 'c' ); | |
| 905 | + if ( ! is_string( $cookie_token ) || '' === trim( $cookie_token ) ) { | |
| 906 | + return; | |
| 907 | + } | |
| 908 | + | |
| 909 | + $transient_key = 'wd-rp-' . COOKIEHASH . '_' . $cookie_token; | |
| 910 | + $value = get_site_transient( $transient_key ); | |
| 911 | + | |
| 898 | 912 | // Process the data and display the result. |
| 899 | 913 | if ( |
| 900 | 914 | isset( $action ) |
| 901 | 915 | && in_array( $action, array( 'rp', 'resetpass' ), true ) |
| 902 | - && isset( $value ) && 0 < strpos( $value, ':' ) | |
| 916 | + && is_string( $value ) && 0 < strpos( $value, ':' ) | |
| 903 | 917 | ) { |
| 904 | 918 | [ $login, $key ] = explode( ':', wp_unslash( $value ), 2 ); |
| 905 | 919 | $user = check_password_reset_key( $key, $login ); |
| 920 | + | |
| 921 | + if ( is_wp_error( $user ) ) { | |
| 922 | + delete_site_transient( $transient_key ); | |
| 923 | + setcookie( $cookie_name, ' ', time() - YEAR_IN_SECONDS, $rp_path, $rp_domain, is_ssl(), true ); | |
| 924 | + unset( $_COOKIE[ $cookie_name ] ); | |
| 925 | + | |
| 926 | + return; | |
| 927 | + } | |
| 928 | + | |
| 906 | 929 | if ( 'resetpass' === $action ) { |
| 907 | - delete_site_transient( 'wd-rp-' . COOKIEHASH ); | |
| 930 | + delete_site_transient( $transient_key ); | |
| 931 | + setcookie( $cookie_name, ' ', time() - YEAR_IN_SECONDS, $rp_path, $rp_domain, is_ssl(), true ); | |
| 932 | + unset( $_COOKIE[ $cookie_name ] ); | |
| 908 | 933 | } |
| 909 | - if ( ! is_wp_error( $user ) ) { | |
| 910 | - $this->render_partial( | |
| 911 | - 'mask-login/reset', | |
| 912 | - array( | |
| 913 | - 'user' => $user, | |
| 914 | - ) | |
| 915 | - ); | |
| 916 | - exit; | |
| 917 | - } | |
| 934 | + | |
| 935 | + $this->render_partial( | |
| 936 | + 'mask-login/reset', | |
| 937 | + array( | |
| 938 | + 'user' => $user, | |
| 939 | + ) | |
| 940 | + ); | |
| 941 | + exit; | |
| 918 | 942 | } |
| 919 | 943 | } |
| 920 | 944 | |
| 921 | 945 | /** |
