← All changes | front-end/edit-profile.php +30 -7 3.16.0 → 4.0.3 View file →

		@@ -49,17 +49,26 @@
49	49	$user_id = absint( $_GET['edit_user'] );
50	50	}
51	51	}
52	52
	53	+ $session_token = '';
	54	+
53	55	if( !isset( $_GET['edit_user'] ) ) {
54		- // Parse the logged-in cookie before clearing it; wp_parse_auth_cookie() can return false when no cookie exists.
	56	+ // Keep the current session token before clearing auth cookies. Some plugins remove the logged-in
	57	+ // - cookie from $_COOKIE on clear_auth_cookie, so wp_get_session_token() can be empty later in this request
55	58	$logged_in_cookie = wp_parse_auth_cookie('', 'logged_in');
56	59	/** This filter is documented in wp-includes/pluggable.php */
57	60	$default_cookie_life = apply_filters('auth_cookie_expiration', (2 * DAY_IN_SECONDS), $user_id, false);
58	61	$remember = false;
59		- if ( is_array( $logged_in_cookie ) && isset( $logged_in_cookie['expiration'] ) ) {
60		- // If expiration is greater than the default, the user checked 'Remember Me' when they logged in.
61		- $remember = ( ( $logged_in_cookie['expiration'] - time() ) > $default_cookie_life );
	62	+ if ( is_array( $logged_in_cookie ) ) {
	63	+ if ( isset( $logged_in_cookie['token'] ) ) {
	64	+ $session_token = $logged_in_cookie['token'];
	65	+ }
	66	+
	67	+ if ( isset( $logged_in_cookie['expiration'] ) ) {
	68	+ // If expiration is greater than the default, the user checked 'Remember Me' when they logged in
	69	+ $remember = ( ( $logged_in_cookie['expiration'] - time() ) > $default_cookie_life );
	70	+ }
62	71	}
63	72
64	73	wp_clear_auth_cookie();
65	74	/* set the new password for the user */
		@@ -64,9 +73,21 @@
64	73	wp_clear_auth_cookie();
65	74	/* set the new password for the user */
66	75	wp_set_password($_POST['passw1'], $user_id);//phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
67	76
68		- wp_set_auth_cookie($user_id, $remember, '', wp_get_session_token() );
	77	+ wp_set_auth_cookie($user_id, $remember, '', $session_token );
	78	+ if ( ! empty( $session_token ) ) {
	79	+ $cookie_life = $remember ? 14 * DAY_IN_SECONDS : 2 * DAY_IN_SECONDS;
	80	+ /** This filter is documented in wp-includes/pluggable.php */
	81	+ $cookie_expiration = time() + apply_filters( 'auth_cookie_expiration', $cookie_life, $user_id, $remember );
	82	+
	83	+ // wp_set_auth_cookie() sends the new browser cookie, but it does not repopulate $_COOKIE
	84	+ // - restore it for the remaining form processing, including the second nonce verification
	85	+ $_COOKIE[ LOGGED_IN_COOKIE ] = wp_generate_auth_cookie( $user_id, $cookie_expiration, 'logged_in', $session_token );
	86	+ }
	87	+
	88	+ wp_set_current_user( $user_id );
	89	+ do_action( 'wppb_edit_profile_password_changed', $user_id );
69	90	}
70	91	else{
71	92	wp_set_password($_POST['passw1'], $user_id); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
72	93	do_action( 'wppb_edit_profile_password_changed', $user_id );
		@@ -73,10 +94,12 @@
73	94	}
74	95
75	96	/* log out of other sessions or all sessions if the admin is editing the profile */
76	97	$sessions = WP_Session_Tokens::get_instance( $user_id );
77		- if ( $user_id === get_current_user_id() ) {
78		- $sessions->destroy_others( wp_get_session_token() );
	98	+ if ( $user_id === get_current_user_id() ) {
	99	+ // Reuse the captured token so destroying other sessions does not depend on the current $_COOKIE state
	100	+ $current_session_token = ! empty( $session_token ) ? $session_token : wp_get_session_token();
	101	+ $sessions->destroy_others( $current_session_token );
79	102	} else {
80	103	$sessions->destroy_all();
81	104	}
82	105