Changeset 56150

Timestamp:

07/06/2023 12:45:45 PM (13 months ago)

Author:

audrasjb

Message:

Users: Remove password reset links when the feature is not allowed for a specific user.

This also introduces wp_is_password_reset_allowed_for_user() which returns false when password reset is not allowed for a specific user. This can be
filtered by developers using the existing allow_password_reset hook.

Props ocean90, cshark, robinwpdeveloper, tahmina1du, kraftbj.
Fixes #58194.

Location:

trunk/src

Files:

• wp-admin/includes/class-wp-users-list-table.php (modified) (1 diff)
• wp-admin/user-edit.php (modified) (1 diff)
• wp-includes/user.php (modified) (2 diffs)

trunk/src/wp-admin/includes/class-wp-users-list-table.php

@@ -503 +503 @@
             if ( get_current_user_id() !== $user_object->ID
                 && current_user_can( 'edit_user', $user_object->ID )
+
             ) {
                 $actions['resetpassword'] = "<a class='resetpassword' href='" . wp_nonce_url( "users.php?action=resetpassword&amp;users=$user_object->ID", 'bulk-users' ) . "'>" . __( 'Send password reset' ) . '</a>';

trunk/src/wp-admin/user-edit.php

@@ -682 +682 @@
 
                             <?php // Allow admins to send reset password link. ?>
-                            <?php if ( ! IS_PROFILE_PAGE ) : ?>
+                            <?php if ( ! IS_PROFILE_PAGE ) : ?>
                                 <tr class="user-generate-reset-link-wrap hide-if-no-js">
                                     <th><?php _e( 'Password Reset' ); ?></th>

trunk/src/wp-includes/user.php

@@ -2898 +2898 @@
     do_action( 'retrieve_password', $user->user_login );
 
-    $allow = true;
-    if ( is_multisite() && is_user_spammy( $user ) ) {
-        $allow = false;
-    }
-
-    /**
-     * Filters whether to allow a password to be reset.
-     *
-     * @since 2.7.0
-     *
-     * @param bool $allow   Whether to allow the password to be reset. Default true.
-     * @param int  $user_id The ID of the user attempting to reset a password.
-     */
-    $allow = apply_filters( 'allow_password_reset', $allow, $user->ID );
-
-    if ( ! $allow ) {
+    $password_reset_allowed = wp_is_password_reset_allowed_for_user( $user );
+    if ( ! $password_reset_allowed ) {
         return new WP_Error( 'no_password_reset', __( 'Password reset is not allowed for this user' ) );
-    } elseif ( is_wp_error( $allow ) ) {
-        return $allow;
+    } elseif ( is_wp_error( $ ) ) {
+        return $;
     }
 
@@ -5038 +5024 @@
     wp_cache_set_last_changed( 'users' );
 }
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+