From d1a708afbff086d1600f4d87e6946f82016e2e3a Mon Sep 17 00:00:00 2001 From: "Edward Z. Yang" Date: Fri, 20 Nov 2009 21:02:26 -0500 Subject: [PATCH] Wordpress 2.8.4 Signed-off-by: Edward Z. Yang --- readme.html | 4 ++-- wp-includes/version.php | 2 +- wp-login.php | 13 ++++++++----- 3 files changed, 11 insertions(+), 8 deletions(-) diff --git a/readme.html b/readme.html index 329e330c..95e1c172 100644 --- a/readme.html +++ b/readme.html @@ -8,7 +8,7 @@

WordPress -
Version 2.8.3 +
Version 2.8.4

Semantic Personal Publishing Platform

@@ -29,7 +29,7 @@

Upgrading

Before you upgrade anything, make sure you have backup copies of any files you may have modified such as index.php.

-

Upgrading from any previous WordPress to 2.8.3:

+

Upgrading from any previous WordPress to 2.8.4:

  1. Delete your old WP files, saving ones you've modified.
  2. Upload the new files.
    3. diff --git a/wp-includes/version.php b/wp-includes/version.php index 05e585cb..22b86360 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -8,7 +8,7 @@ * * @global string $wp_version */ -$wp_version = '2.8.3'; +$wp_version = '2.8.4'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. diff --git a/wp-login.php b/wp-login.php index 62898123..5378204d 100644 --- a/wp-login.php +++ b/wp-login.php @@ -161,7 +161,7 @@ function retrieve_password() { $message .= get_option('siteurl') . "\r\n\r\n"; $message .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n"; $message .= __('To reset your password visit the following address, otherwise just ignore this email and nothing will happen.') . "\r\n\r\n"; - $message .= site_url("wp-login.php?action=rp&key=$key", 'login') . "\r\n"; + $message .= site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . "\r\n"; $title = sprintf(__('[%s] Password Reset'), get_option('blogname')); @@ -182,15 +182,18 @@ function retrieve_password() { * @param string $key Hash to validate sending user's password * @return bool|WP_Error */ -function reset_password($key) { +function reset_password($key, $login) { global $wpdb; $key = preg_replace('/[^a-z0-9]/i', '', $key); - if ( empty( $key ) ) + if ( empty( $key ) || !is_string( $key ) ) return new WP_Error('invalid_key', __('Invalid key')); - $user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_activation_key = %s", $key)); + if ( empty($login) || !is_string($login) ) + return new WP_Error('invalid_key', __('Invalid key')); + + $user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_activation_key = %s AND user_login = %s", $key, $login)); if ( empty( $user ) ) return new WP_Error('invalid_key', __('Invalid key')); @@ -370,7 +373,7 @@ break; case 'resetpass' : case 'rp' : - $errors = reset_password($_GET['key']); + $errors = reset_password($_GET['key'], $_GET['login']); if ( ! is_wp_error($errors) ) { wp_redirect('wp-login.php?checkemail=newpass'); -- 2.44.0