check_password_reset_key()
最后更新于:2021-11-25 20:30:17
check_password_reset_key( string$key, string$login)Retrieves a user row based on password reset key and login
参数
- $key
-
(string) (Required) Hash to validate sending user’s password.
- $login
-
(string) (Required) The user login.
响应
(GC_User|GC_Error) GC_User object on success, GC_Error object for invalid or expired keys.
源文件
文件: gc-includes/user.php
function check_password_reset_key( $key, $login ) {
global $gcdb, $gc_hasher;
$key = preg_replace( '/[^a-z0-9]/i', '', $key );
if ( empty( $key ) || ! is_string( $key ) ) {
return new GC_Error( 'invalid_key', __( 'Invalid key.' ) );
}
if ( empty( $login ) || ! is_string( $login ) ) {
return new GC_Error( 'invalid_key', __( 'Invalid key.' ) );
}
$user = get_user_by( 'login', $login );
if ( ! $user ) {
return new GC_Error( 'invalid_key', __( 'Invalid key.' ) );
}
if ( empty( $gc_hasher ) ) {
require_once ABSPATH . GCINC . '/class-phpass.php';
$gc_hasher = new PasswordHash( 8, true );
}
/**
* Filters the expiration time of password reset keys.
*
* @since 4.3.0
*
* @param int $expiration The expiration time in seconds.
*/
$expiration_duration = apply_filters( 'password_reset_expiration', DAY_IN_SECONDS );
if ( false !== strpos( $user->user_activation_key, ':' ) ) {
list( $pass_request_time, $pass_key ) = explode( ':', $user->user_activation_key, 2 );
$expiration_time = $pass_request_time + $expiration_duration;
} else {
$pass_key = $user->user_activation_key;
$expiration_time = false;
}
if ( ! $pass_key ) {
return new GC_Error( 'invalid_key', __( 'Invalid key.' ) );
}
$hash_is_correct = $gc_hasher->CheckPassword( $key, $pass_key );
if ( $hash_is_correct && $expiration_time && time() < $expiration_time ) {
return $user;
} elseif ( $hash_is_correct && $expiration_time ) {
// Key has an expiration time that's passed.
return new GC_Error( 'expired_key', __( 'Invalid key.' ) );
}
if ( hash_equals( $user->user_activation_key, $key ) || ( $hash_is_correct && ! $expiration_time ) ) {
$return = new GC_Error( 'expired_key', __( 'Invalid key.' ) );
$user_id = $user->ID;
/**
* Filters the return value of check_password_reset_key() when an
* old-style key is used.
*
* @since 3.7.0 Previously plain-text keys were stored in the database.
* @since 4.3.0 Previously key hashes were stored without an expiration time.
*
* @param GC_Error $return A GC_Error object denoting an expired key.
* 响应 a GC_User object to validate the key.
* @param int $user_id The matched user ID.
*/
return apply_filters( 'password_reset_key_expired', $return, $user_id );
}
return new GC_Error( 'invalid_key', __( 'Invalid key.' ) );
}