Changeset 10028

Timestamp:

07/07/2020 06:54:11 AM (6 years ago)

Author:

dd32

Message:

Login: Don't change the activation key upon every resend.

Changing the activation key without changing the email address can cause expired links to be used when delayed.

See #5278.

File:

• sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/functions-registration.php (modified) (3 diffs)

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/functions-registration.php

@@ -57 +57 @@
                 wp_die( __( 'Registration Blocked. Please stop.', 'wporg' ) );
         }
-
 
         $profile_key        = wp_generate_password( 24, false, false );
@@ -113 +112 @@
         $user = wporg_get_pending_user( $user_email );
 
-        if ( ! $user ) {
+        if ( ! $user || $user['created'] ) {
                 return false;
         }
@@ -119 +118 @@
         $user_login = $user['user_login'];
 
-        // Every email gets a new key (and expiration time..)
-        $activation_key        = wp_generate_password( 24, false, false );
-        $hashed_activation_key = time() . ':' . wp_hash_password( $activation_key );
-
-        $user['user_activation_key'] = $hashed_activation_key;
+        $activation_key = wp_hash( $user_login . ':' . $user_email, 'activation' );
+
+        // Every email bumps the expiration time.
+        $user['user_activation_key'] = time() . ':' . wp_hash_password( $activation_key );
         if ( ! wporg_update_pending_user( $user ) ) {
                 return false;