| @@ -875,8 +875,12 @@ | ||
| 875 | 875 | $action = defender_get_data_from_request( 'action', 'g' ); |
| 876 | 876 | $key = wp_unslash( defender_get_data_from_request( 'key', 'r' ) ); |
| 877 | 877 | $login = wp_unslash( defender_get_data_from_request( 'login', 'r' ) ); |
| 878 | 878 | $wd_ml_token = defender_get_data_from_request( 'wd-ml-token', 'g' ); |
| 879 | + $cookie_name = 'wd-rp-' . COOKIEHASH; | |
| 880 | + $rp_path = defined( 'COOKIEPATH' ) ? COOKIEPATH : '/'; | |
| 881 | + $rp_domain = defined( 'COOKIE_DOMAIN' ) ? COOKIE_DOMAIN : ''; | |
| 882 | + | |
| 879 | 883 | if ( |
| 880 | 884 | isset( $action, $key, $login, $wd_ml_token ) |
| 881 | 885 | && 'rp' === $action |
| 882 | 886 | && $login === $wd_ml_token |
| @@ -883,35 +887,59 @@ | ||
| 883 | 887 | ) { |
| 884 | 888 | |
| 885 | 889 | $user = check_password_reset_key( $key, $login ); |
| 886 | 890 | if ( ! is_wp_error( $user ) ) { |
| 887 | - $value = sprintf( '%s:%s', $login, $key ); | |
| 888 | - set_site_transient( 'wd-rp-' . COOKIEHASH, $value, 2 * MINUTE_IN_SECONDS ); | |
| 891 | + $token = wp_generate_password( 20, false ); | |
| 892 | + $transient_key = 'wd-rp-' . COOKIEHASH . '_' . $token; | |
| 893 | + $value = sprintf( '%s:%s', $login, $key ); | |
| 894 | + | |
| 895 | + set_site_transient( $transient_key, $value, 2 * MINUTE_IN_SECONDS ); | |
| 896 | + setcookie( $cookie_name, $token, 0, $rp_path, $rp_domain, is_ssl(), true ); | |
| 897 | + $_COOKIE[ $cookie_name ] = $token; | |
| 898 | + | |
| 889 | 899 | wp_safe_redirect( remove_query_arg( array( 'key', 'login', 'wd-ml-token' ) ) ); |
| 890 | 900 | exit; |
| 891 | 901 | } |
| 892 | 902 | } |
| 893 | - $value = get_site_transient( 'wd-rp-' . COOKIEHASH ); | |
| 903 | + | |
| 904 | + $cookie_token = defender_get_data_from_request( $cookie_name, 'c' ); | |
| 905 | + if ( ! is_string( $cookie_token ) || '' === trim( $cookie_token ) ) { | |
| 906 | + return; | |
| 907 | + } | |
| 908 | + | |
| 909 | + $transient_key = 'wd-rp-' . COOKIEHASH . '_' . $cookie_token; | |
| 910 | + $value = get_site_transient( $transient_key ); | |
| 911 | + | |
| 894 | 912 | // Process the data and display the result. |
| 895 | 913 | if ( |
| 896 | 914 | isset( $action ) |
| 897 | 915 | && in_array( $action, array( 'rp', 'resetpass' ), true ) |
| 898 | - && isset( $value ) && 0 < strpos( $value, ':' ) | |
| 916 | + && is_string( $value ) && 0 < strpos( $value, ':' ) | |
| 899 | 917 | ) { |
| 900 | 918 | [ $login, $key ] = explode( ':', wp_unslash( $value ), 2 ); |
| 901 | 919 | $user = check_password_reset_key( $key, $login ); |
| 920 | + | |
| 921 | + if ( is_wp_error( $user ) ) { | |
| 922 | + delete_site_transient( $transient_key ); | |
| 923 | + setcookie( $cookie_name, ' ', time() - YEAR_IN_SECONDS, $rp_path, $rp_domain, is_ssl(), true ); | |
| 924 | + unset( $_COOKIE[ $cookie_name ] ); | |
| 925 | + | |
| 926 | + return; | |
| 927 | + } | |
| 928 | + | |
| 902 | 929 | if ( 'resetpass' === $action ) { |
| 903 | - delete_site_transient( 'wd-rp-' . COOKIEHASH ); | |
| 930 | + delete_site_transient( $transient_key ); | |
| 931 | + setcookie( $cookie_name, ' ', time() - YEAR_IN_SECONDS, $rp_path, $rp_domain, is_ssl(), true ); | |
| 932 | + unset( $_COOKIE[ $cookie_name ] ); | |
| 904 | 933 | } |
| 905 | - if ( ! is_wp_error( $user ) ) { | |
| 906 | - $this->render_partial( | |
| 907 | - 'mask-login/reset', | |
| 908 | - array( | |
| 909 | - 'user' => $user, | |
| 910 | - ) | |
| 911 | - ); | |
| 912 | - exit; | |
| 913 | - } | |
| 934 | + | |
| 935 | + $this->render_partial( | |
| 936 | + 'mask-login/reset', | |
| 937 | + array( | |
| 938 | + 'user' => $user, | |
| 939 | + ) | |
| 940 | + ); | |
| 941 | + exit; | |
| 914 | 942 | } |
| 915 | 943 | } |
| 916 | 944 | |
| 917 | 945 | /** |
