Changeset 61610

Timestamp:

02/10/2026 07:51:56 PM (6 days ago)

Author:

joedolson

Message:

Login and Registration: Populate username after password reset.

Accessibility: to meet WCAG 2.2/3.3.7: Redundant entry, the username should be auto-populated when a user performs a password reset.

There is an existing cookie set that contains this information, but was deleted before displaying the login form.

Move cookie deletion to occur after displaying login form and use to set $user_login.

Props estelaris, alh0319, sabernhardt, oglekler, peterwilsoncc, rcreators, rishavdutta, chaion07, stoyangeorgiev, rinkalpagdar, pratiklondhe, lukasfritzedev, ferdoused, audrasjb, westonruter, joedolson.
Fixes #60726.

File:

• trunk/src/wp-login.php (modified) (2 diffs)

trunk/src/wp-login.php

@@ -1001 +1001 @@
         if ( ( ! $errors->has_errors() ) && isset( $_POST['pass1'] ) && ! empty( $_POST['pass1'] ) ) {
             reset_password( $user, $_POST['pass1'] );
-            setcookie( $rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true );
             login_header(
                 __( 'Password Reset' ),
@@ -1488 +1487 @@
         }
 
+        // Obtain user from password reset cookie flow before clearing the cookie.
+        $rp_cookie = 'wp-resetpass-' . COOKIEHASH;
+        if ( isset( $_COOKIE[ $rp_cookie ] ) && is_string( $_COOKIE[ $rp_cookie ] ) ) {
+            $user_login      = sanitize_user( strtok( wp_unslash( $_COOKIE[ $rp_cookie ] ), ':' ) );
+            list( $rp_path ) = explode( '?', wp_unslash( $_SERVER['REQUEST_URI'] ) );
+            setcookie( $rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true );
+        }
+
         login_header( __( 'Log In' ), '', $errors );