User: Invalidate user_activation_key on password update.

whyisjake · whyisjake · commit 4354d1fc5cd5 · 2020-04-29T15:23:37.000Z
Props: sstoqnov, sergeybiryukov. git-svn-id: https://develop.svn.wordpress.org/trunk@47634 602fd350-edb4-49c9-b593-d223f7449a82
diff --git a/src/wp-includes/user.php b/src/wp-includes/user.php
@@ -1812,7 +1812,7 @@ function wp_insert_user( $userdata ) {
 	}
 
 	if ( $update ) {
-		if ( $user_email !== $old_user_data->user_email ) {
+		if ( $user_email !== $old_user_data->user_email || $user_pass !== $old_user_data->user_pass ) {
 			$data['user_activation_key'] = '';
 		}
 		$wpdb->update( $wpdb->users, $data, compact( 'ID' ) );
diff --git a/tests/phpunit/tests/user.php b/tests/phpunit/tests/user.php
@@ -1036,7 +1036,7 @@ public function test_wp_update_user_should_delete_userslugs_cache() {
 		$this->assertEquals( $u, wp_cache_get( $updated_user->user_nicename, 'userslugs' ) );
 	}
 
-	function test_changing_email_invalidates_password_reset_key() {
+	public function test_changing_email_invalidates_password_reset_key() {
 		global $wpdb;
 
 		$user = $this->author;
@@ -1068,6 +1068,26 @@ function test_changing_email_invalidates_password_reset_key() {
 		$this->assertEmpty( $user->user_activation_key );
 	}
 
+	public function test_changing_password_invalidates_password_reset_key() {
+		global $wpdb;
+
+		$user = $this->author;
+		$wpdb->update( $wpdb->users, array( 'user_activation_key' => 'key' ), array( 'ID' => $user->ID ) );
+		clean_user_cache( $user );
+
+		$user = get_userdata( $user->ID );
+		$this->assertEquals( 'key', $user->user_activation_key );
+
+		$userdata = array(
+			'ID'        => $user->ID,
+			'user_pass' => 'password',
+		);
+		wp_update_user( $userdata );
+
+		$user = get_userdata( $user->ID );
+		$this->assertEmpty( $user->user_activation_key );
+	}
+
 	public function test_search_users_login() {
 		$users = get_users(
 			array(

Original file line number	Diff line number	Diff line change
`@@ -1812,7 +1812,7 @@ function wp_insert_user( $userdata ) {`
`1812`	`1812`	`}`
`1813`	`1813`
`1814`	`1814`	`if ( $update ) {`
`1815`		`- if ( $user_email !== $old_user_data->user_email ) {`
	`1815`	`+ if ( $user_email !== $old_user_data->user_email \|\| $user_pass !== $old_user_data->user_pass ) {`
`1816`	`1816`	`$data['user_activation_key'] = '';`
`1817`	`1817`	`}`
`1818`	`1818`	`$wpdb->update( $wpdb->users, $data, compact( 'ID' ) );`