From 28d12c612e4f053ed758aa53439f5f1ef37ffa2c Mon Sep 17 00:00:00 2001 From: Jeremy Felt Date: Wed, 27 Apr 2016 05:54:40 +0000 Subject: [PATCH] Users: Prevent spammy users from resetting their passwords in multisite Props r-a-y, websupporter. Fixes #24617. git-svn-id: https://develop.svn.wordpress.org/trunk@37317 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/user.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/wp-includes/user.php b/src/wp-includes/user.php index 48c6e84f4a..4ac9fe93b9 100644 --- a/src/wp-includes/user.php +++ b/src/wp-includes/user.php @@ -2036,6 +2036,11 @@ function get_password_reset_key( $user ) { */ do_action( 'retrieve_password', $user->user_login ); + $allow = true; + if ( is_multisite() && is_user_spammy( $user ) ) { + $allow = false; + } + /** * Filter whether to allow a password to be reset. * @@ -2044,7 +2049,7 @@ function get_password_reset_key( $user ) { * @param bool $allow Whether to allow the password to be reset. Default true. * @param int $user_data->ID The ID of the user attempting to reset a password. */ - $allow = apply_filters( 'allow_password_reset', true, $user->ID ); + $allow = apply_filters( 'allow_password_reset', $allow, $user->ID ); if ( ! $allow ) { return new WP_Error( 'no_password_reset', __( 'Password reset is not allowed for this user' ) );