Fix for 44940: Add plain_text_confirm_key to WP_User_Request in email#9617
Fix for 44940: Add plain_text_confirm_key to WP_User_Request in email#9617Vedanshmini26 wants to merge 1 commit intoWordPress:trunkfrom
Conversation
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
|
This PR appears to be spam. The code changes do not match the description in any way. |
Trac Link: https://core.trac.wordpress.org/ticket/44940
Problem
When using the user_request_action_email_content filter to customize data request emails, the confirm_key property in the WP_User_Request object is empty, making it impossible to create custom confirmation URLs while maintaining the security flow.
Root Cause
WordPress stores the confirmation key in a hashed format in the database for security reasons. When the WP_User_Request object is created, it loads this hashed value into the confirm_key property. However, the confirmation URL in the email uses a plain-text key generated by wp_generate_user_request_key(). This creates a discrepancy where the URL contains the usable key, but the object property contains only the hashed version.
Solution
The implemented solution adds a filter that:
Extracts the plain text confirmation key from the confirm_url parameter
Adds it to the request object as a new property called plain_confirm_key
Makes this value available to any code using the user_request_action_email_content filter
This approach maintains WordPress's security model while providing developers with the necessary information to create custom confirmation flows.
Expected Behavior After Fix
After applying this fix, developers can:
Access the plain text confirmation key via $email_data['request']->plain_confirm_key
Create custom confirmation URLs with their own styling and routing
Maintain the security of the confirmation process
Implement custom email templates with branded styling and links