From 1023d2bc6044bdc91c16004d41f2cd733e07b566 Mon Sep 17 00:00:00 2001
From: Andrew Nacin <nacin@git.wordpress.org>
Date: Thu, 20 Nov 2014 12:21:45 +0000
Subject: [PATCH] Form validation for password resets.

git-svn-id: https://develop.svn.wordpress.org/trunk@30417 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-login.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/wp-login.php b/src/wp-login.php
index ffd50e68ea..7ed69bc74d 100644
--- a/src/wp-login.php
+++ b/src/wp-login.php
@@ -576,6 +576,9 @@ case 'rp' :
 	if ( isset( $_COOKIE[ $rp_cookie ] ) && 0 < strpos( $_COOKIE[ $rp_cookie ], ':' ) ) {
 		list( $rp_login, $rp_key ) = explode( ':', wp_unslash( $_COOKIE[ $rp_cookie ] ), 2 );
 		$user = check_password_reset_key( $rp_key, $rp_login );
+		if ( isset( $_POST['pass1'] ) && ! hash_equals( $rp_key, $_POST['rp_key'] ) ) {
+			$user = false;
+		}
 	} else {
 		$user = false;
 	}
@@ -644,6 +647,7 @@ case 'rp' :
 	 */
 	do_action( 'resetpass_form', $user );
 	?>
+	<input type="hidden" name="rp_key" value="<?php echo esc_attr( $rp_key ); ?>" />
 	<p class="submit"><input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e('Reset Password'); ?>" /></p>
 </form>