WordPress 4.1.4-scripts

[autoinstalls/wordpress.git] / wp-login.php

diff --git a/wp-login.php b/wp-login.php
index b9dbd61e52b4ea5fb93c9b0c47decc66db43bdd9..3dabec4a4ca35eac793e7d9f9e62ecb1ed07d9dc 100644 (file)
--- a/wp-login.php
+++ b/wp-login.php
@@ -25,7 +25,8 @@ if ( force_ssl_admin() && ! is_ssl() ) {
 /**
  * Output the login page header.
  *
- * @param string   $title    Optional. WordPress Log In Page title to display in <title> element. Default 'Log In'.
+ * @param string   $title    Optional. WordPress login Page title to display in the `<title>` element.
+ *                           Default 'Log In'.
  * @param string   $message  Optional. Message to display in header. Default empty.
  * @param WP_Error $wp_error Optional. The error to pass. Default empty.
  */
@@ -263,7 +264,8 @@ function wp_login_viewport_meta() {
 /**
  * Handles sending password retrieval email to user.
  *
- * @uses $wpdb WordPress Database object
+ * @global wpdb         $wpdb      WordPress database abstraction object.
+ * @global PasswordHash $wp_hasher Portable PHP password hashing framework.
  *
  * @return bool|WP_Error True: when finish. WP_Error on error
  */
@@ -383,15 +385,19 @@ function retrieve_password() {
         * @param string $title Default email title.
         */
        $title = apply_filters( 'retrieve_password_title', $title );
+
        /**
         * Filter the message body of the password reset mail.
         *
         * @since 2.8.0
+        * @since 4.1.0 Added `$user_login` and `$user_data` parameters.
         *
-        * @param string $message Default mail message.
-        * @param string $key     The activation key.
+        * @param string  $message    Default mail message.
+        * @param string  $key        The activation key.
+        * @param string  $user_login The username for the user.
+        * @param WP_User $user_data  WP_User object.
         */
-       $message = apply_filters( 'retrieve_password_message', $message, $key );
+       $message = apply_filters( 'retrieve_password_message', $message, $key, $user_login, $user_data );
 
        if ( $message && !wp_mail( $user_email, wp_specialchars_decode( $title ), $message ) )
                wp_die( __('The e-mail could not be sent.') . "<br />\n" . __('Possible reason: your host may have disabled the mail() function.') );
@@ -441,7 +447,7 @@ do_action( 'login_init' );
 /**
  * Fires before a specified login form action.
  *
- * The dynamic portion of the hook name, $action, refers to the action
+ * The dynamic portion of the hook name, `$action`, refers to the action
  * that brought the visitor to the login form. Actions include 'postpass',
  * 'logout', 'lostpassword', etc.
  *
@@ -532,7 +538,7 @@ case 'retrievepassword' :
        </p>
        <?php
        /**
-        * Fires inside the lostpassword <form> tags, before the hidden fields.
+        * Fires inside the lostpassword form tags, before the hidden fields.
         *
         * @since 2.1.0
         */
@@ -571,6 +577,9 @@ case 'rp' :
        if ( isset( $_COOKIE[ $rp_cookie ] ) && 0 < strpos( $_COOKIE[ $rp_cookie ], ':' ) ) {
                list( $rp_login, $rp_key ) = explode( ':', wp_unslash( $_COOKIE[ $rp_cookie ] ), 2 );
                $user = check_password_reset_key( $rp_key, $rp_login );
+               if ( isset( $_POST['pass1'] ) && ! hash_equals( $rp_key, $_POST['rp_key'] ) ) {
+                       $user = false;
+               }
        } else {
                $user = false;
        }
@@ -626,8 +635,7 @@ case 'rp' :
        </p>
 
        <div id="pass-strength-result" class="hide-if-no-js"><?php _e('Strength indicator'); ?></div>
-       <p class="description indicator-hint"><?php _e('Hint: The password should be at least seven characters long. To make it stronger, use upper and lower case letters, numbers, and symbols like ! " ? $ % ^ &amp; ).'); ?></p>
-
+       <p class="description indicator-hint"><?php echo wp_get_password_hint(); ?></p>
        <br class="clear" />
 
        <?php
@@ -640,6 +648,7 @@ case 'rp' :
         */
        do_action( 'resetpass_form', $user );
        ?>
+       <input type="hidden" name="rp_key" value="<?php echo esc_attr( $rp_key ); ?>" />
        <p class="submit"><input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e('Reset Password'); ?>" /></p>
 </form>