' . sprintf( __( 'Your email address has not been updated yet. Please check your inbox at %s for a confirmation email.' ), '' . esc_html( $email['newemail'] ) . '' ) . '
' . esc_html( $email['newemail'] ) . ''
+ );
+ wp_admin_notice( $message, array( 'type' => 'info' ) );
}
}
}
@@ -3728,7 +3817,7 @@
* @since 4.9.6
* @access private
*
- * @return array List of core privacy action types.
+ * @return string[] List of core privacy action types.
*/
function _wp_privacy_action_request_types() {
return array(
@@ -3742,8 +3831,8 @@
*
* @since 4.9.6
*
- * @param array $exporters An array of personal data exporters.
- * @return array An array of personal data exporters.
+ * @param array[] $exporters An array of personal data exporters.
+ * @return array[] An array of personal data exporters.
*/
function wp_register_user_personal_data_exporter( $exporters ) {
$exporters['wordpress-user'] = array(
@@ -3762,7 +3851,12 @@
* @since 5.4.0 Added 'Session Tokens' group to the export data.
*
* @param string $email_address The user's email address.
- * @return array An array of personal data.
+ * @return array {
+ * An array of personal data.
+ *
+ * @type array[] $data An array of personal data arrays.
+ * @type bool $done Whether the exporter is finished.
+ * }
*/
function wp_user_personal_data_exporter( $email_address ) {
$email_address = trim( $email_address );
@@ -3849,7 +3943,7 @@
// Remove items that use reserved names.
$extra_data = array_filter(
$_extra_data,
- static function( $item ) use ( $reserved_names ) {
+ static function ( $item ) use ( $reserved_names ) {
return ! in_array( $item['name'], $reserved_names, true );
}
);
@@ -3993,7 +4087,7 @@
function _wp_privacy_send_request_confirmation_notification( $request_id ) {
$request = wp_get_user_request( $request_id );
- if ( ! is_a( $request, 'WP_User_Request' ) || 'request-confirmed' !== $request->status ) {
+ if ( ! ( $request instanceof WP_User_Request ) || 'request-confirmed' !== $request->status ) {
return;
}
@@ -4158,8 +4252,8 @@
$content = str_replace( '###SITENAME###', $email_data['sitename'], $content );
$content = str_replace( '###USER_EMAIL###', $email_data['user_email'], $content );
$content = str_replace( '###DESCRIPTION###', $email_data['description'], $content );
- $content = str_replace( '###MANAGE_URL###', esc_url_raw( $email_data['manage_url'] ), $content );
- $content = str_replace( '###SITEURL###', esc_url_raw( $email_data['siteurl'] ), $content );
+ $content = str_replace( '###MANAGE_URL###', sanitize_url( $email_data['manage_url'] ), $content );
+ $content = str_replace( '###SITEURL###', sanitize_url( $email_data['siteurl'] ), $content );
$headers = '';
@@ -4205,7 +4299,7 @@
function _wp_privacy_send_erasure_fulfillment_notification( $request_id ) {
$request = wp_get_user_request( $request_id );
- if ( ! is_a( $request, 'WP_User_Request' ) || 'request-completed' !== $request->status ) {
+ if ( ! ( $request instanceof WP_User_Request ) || 'request-completed' !== $request->status ) {
return;
}
@@ -4217,12 +4311,10 @@
// Localize message content for user; fallback to site default for visitors.
if ( ! empty( $request->user_id ) ) {
- $locale = get_user_locale( $request->user_id );
+ $switched_locale = switch_to_user_locale( $request->user_id );
} else {
- $locale = get_locale();
- }
-
- $switched_locale = switch_to_locale( $locale );
+ $switched_locale = switch_to_locale( get_locale() );
+ }
/**
* Filters the recipient of the data erasure fulfillment notification.
@@ -4399,7 +4491,7 @@
$content = str_replace( '###SITENAME###', $email_data['sitename'], $content );
$content = str_replace( '###PRIVACY_POLICY_URL###', $email_data['privacy_policy_url'], $content );
- $content = str_replace( '###SITEURL###', esc_url_raw( $email_data['siteurl'] ), $content );
+ $content = str_replace( '###SITEURL###', sanitize_url( $email_data['siteurl'] ), $content );
$headers = '';
@@ -4628,12 +4720,10 @@
// Localize message content for user; fallback to site default for visitors.
if ( ! empty( $request->user_id ) ) {
- $locale = get_user_locale( $request->user_id );
+ $switched_locale = switch_to_user_locale( $request->user_id );
} else {
- $locale = get_locale();
- }
-
- $switched_locale = switch_to_locale( $locale );
+ $switched_locale = switch_to_locale( get_locale() );
+ }
$email_data = array(
'request' => $request,
@@ -4720,10 +4810,10 @@
$content = apply_filters( 'user_request_action_email_content', $content, $email_data );
$content = str_replace( '###DESCRIPTION###', $email_data['description'], $content );
- $content = str_replace( '###CONFIRM_URL###', esc_url_raw( $email_data['confirm_url'] ), $content );
+ $content = str_replace( '###CONFIRM_URL###', sanitize_url( $email_data['confirm_url'] ), $content );
$content = str_replace( '###EMAIL###', $email_data['email'], $content );
$content = str_replace( '###SITENAME###', $email_data['sitename'], $content );
- $content = str_replace( '###SITEURL###', esc_url_raw( $email_data['siteurl'] ), $content );
+ $content = str_replace( '###SITEURL###', sanitize_url( $email_data['siteurl'] ), $content );
$headers = '';
@@ -4767,6 +4857,8 @@
*
* @since 4.9.6
*
+ * @global PasswordHash $wp_hasher Portable PHP password hashing framework instance.
+ *
* @param int $request_id Request ID.
* @return string Confirmation key.
*/
@@ -4798,6 +4890,8 @@
*
* @since 4.9.6
*
+ * @global PasswordHash $wp_hasher Portable PHP password hashing framework instance.
+ *
* @param string $request_id ID of the request being confirmed.
* @param string $key Provided key to validate.
* @return true|WP_Error True on success, WP_Error on failure.
@@ -4936,3 +5030,91 @@
*/
return apply_filters( 'wp_is_application_passwords_available_for_user', true, $user );
}
+
+/**
+ * Registers the user meta property for persisted preferences.
+ *
+ * This property is used to store user preferences across page reloads and is
+ * currently used by the block editor for preferences like 'fullscreenMode' and
+ * 'fixedToolbar'.
+ *
+ * @since 6.1.0
+ * @access private
+ *
+ * @global wpdb $wpdb WordPress database abstraction object.
+ */
+function wp_register_persisted_preferences_meta() {
+ /*
+ * Create a meta key that incorporates the blog prefix so that each site
+ * on a multisite can have distinct user preferences.
+ */
+ global $wpdb;
+ $meta_key = $wpdb->get_blog_prefix() . 'persisted_preferences';
+
+ register_meta(
+ 'user',
+ $meta_key,
+ array(
+ 'type' => 'object',
+ 'single' => true,
+ 'show_in_rest' => array(
+ 'name' => 'persisted_preferences',
+ 'type' => 'object',
+ 'schema' => array(
+ 'type' => 'object',
+ 'context' => array( 'edit' ),
+ 'properties' => array(
+ '_modified' => array(
+ 'description' => __( 'The date and time the preferences were updated.' ),
+ 'type' => 'string',
+ 'format' => 'date-time',
+ 'readonly' => false,
+ ),
+ ),
+ 'additionalProperties' => true,
+ ),
+ ),
+ )
+ );
+}
+
+/**
+ * Sets the last changed time for the 'users' cache group.
+ *
+ * @since 6.3.0
+ */
+function wp_cache_set_users_last_changed() {
+ wp_cache_set_last_changed( 'users' );
+}
+
+/**
+ * Checks if password reset is allowed for a specific user.
+ *
+ * @since 6.3.0
+ *
+ * @param int|WP_User $user The user to check.
+ * @return bool|WP_Error True if allowed, false or WP_Error otherwise.
+ */
+function wp_is_password_reset_allowed_for_user( $user ) {
+ if ( ! is_object( $user ) ) {
+ $user = get_userdata( $user );
+ }
+
+ if ( ! $user || ! $user->exists() ) {
+ return false;
+ }
+ $allow = true;
+ if ( is_multisite() && is_user_spammy( $user ) ) {
+ $allow = false;
+ }
+
+ /**
+ * Filters whether to allow a password to be reset.
+ *
+ * @since 2.7.0
+ *
+ * @param bool $allow Whether to allow the password to be reset. Default true.
+ * @param int $user_id The ID of the user attempting to reset a password.
+ */
+ return apply_filters( 'allow_password_reset', $allow, $user->ID );
+}