###
To confirm this, please click on the following link:
###CONFIRM_URL###
You can safely ignore and delete this email if you do not want to
take this action.
Regards,
All at ###SITENAME###
###SITEURL###'
);
/**
* Filters the text of the email sent when an account action is attempted.
*
* The following strings have a special meaning and will get replaced dynamically:
*
* ###DESCRIPTION### Description of the action being performed so the user knows what the email is for.
* ###CONFIRM_URL### The link to click on to confirm the account action.
* ###SITENAME### The name of the site.
* ###SITEURL### The URL to the site.
*
* @since 4.9.6
*
* @param string $content Text in the email.
* @param array $email_data {
* Data relating to the account action email.
*
* @type WP_User_Request $request User request object.
* @type string $email The email address this is being sent to.
* @type string $description Description of the action being performed so the user knows what the email is for.
* @type string $confirm_url The link to click on to confirm the account action.
* @type string $sitename The site name sending the mail.
* @type string $siteurl The site URL sending the mail.
* }
*/
$content = apply_filters( 'user_request_action_email_content', $content, $email_data );
$content = str_replace( '###DESCRIPTION###', $email_data['description'], $content );
$content = str_replace( '###CONFIRM_URL###', sanitize_url( $email_data['confirm_url'] ), $content );
$content = str_replace( '###EMAIL###', $email_data['email'], $content );
$content = str_replace( '###SITENAME###', $email_data['sitename'], $content );
$content = str_replace( '###SITEURL###', sanitize_url( $email_data['siteurl'] ), $content );
$headers = '';
/**
* Filters the headers of the email sent when an account action is attempted.
*
* @since 5.4.0
*
* @param string|array $headers The email headers.
* @param string $subject The email subject.
* @param string $content The email content.
* @param int $request_id The request ID.
* @param array $email_data {
* Data relating to the account action email.
*
* @type WP_User_Request $request User request object.
* @type string $email The email address this is being sent to.
* @type string $description Description of the action being performed so the user knows what the email is for.
* @type string $confirm_url The link to click on to confirm the account action.
* @type string $sitename The site name sending the mail.
* @type string $siteurl The site URL sending the mail.
* }
*/
$headers = apply_filters( 'user_request_action_email_headers', $headers, $subject, $content, $request_id, $email_data );
$email_sent = wp_mail( $email_data['email'], $subject, $content, $headers );
if ( $switched_locale ) {
restore_previous_locale();
}
if ( ! $email_sent ) {
return new WP_Error( 'privacy_email_error', __( 'Unable to send personal data export confirmation email.' ) );
}
return true;
}
/**
* Returns a confirmation key for a user action and stores the hashed version for future comparison.
*
* @since 4.9.6
*
* @global PasswordHash $wp_hasher Portable PHP password hashing framework instance.
*
* @param int $request_id Request ID.
* @return string Confirmation key.
*/
function wp_generate_user_request_key( $request_id ) {
global $wp_hasher;
// Generate something random for a confirmation key.
$key = wp_generate_password( 20, false );
// Return the key, hashed.
if ( empty( $wp_hasher ) ) {
require_once ABSPATH . WPINC . '/class-phpass.php';
$wp_hasher = new PasswordHash( 8, true );
}
wp_update_post(
array(
'ID' => $request_id,
'post_status' => 'request-pending',
'post_password' => $wp_hasher->HashPassword( $key ),
)
);
return $key;
}
/**
* Validates a user request by comparing the key with the request's key.
*
* @since 4.9.6
*
* @global PasswordHash $wp_hasher Portable PHP password hashing framework instance.
*
* @param string $request_id ID of the request being confirmed.
* @param string $key Provided key to validate.
* @return true|WP_Error True on success, WP_Error on failure.
*/
function wp_validate_user_request_key( $request_id, $key ) {
global $wp_hasher;
$request_id = absint( $request_id );
$request = wp_get_user_request( $request_id );
$saved_key = $request->confirm_key;
$key_request_time = $request->modified_timestamp;
if ( ! $request || ! $saved_key || ! $key_request_time ) {
return new WP_Error( 'invalid_request', __( 'Invalid personal data request.' ) );
}
if ( ! in_array( $request->status, array( 'request-pending', 'request-failed' ), true ) ) {
return new WP_Error( 'expired_request', __( 'This personal data request has expired.' ) );
}
if ( empty( $key ) ) {
return new WP_Error( 'missing_key', __( 'The confirmation key is missing from this personal data request.' ) );
}
if ( empty( $wp_hasher ) ) {
require_once ABSPATH . WPINC . '/class-phpass.php';
$wp_hasher = new PasswordHash( 8, true );
}
/**
* Filters the expiration time of confirm keys.
*
* @since 4.9.6
*
* @param int $expiration The expiration time in seconds.
*/
$expiration_duration = (int) apply_filters( 'user_request_key_expiration', DAY_IN_SECONDS );
$expiration_time = $key_request_time + $expiration_duration;
if ( ! $wp_hasher->CheckPassword( $key, $saved_key ) ) {
return new WP_Error( 'invalid_key', __( 'The confirmation key is invalid for this personal data request.' ) );
}
if ( ! $expiration_time || time() > $expiration_time ) {
return new WP_Error( 'expired_key', __( 'The confirmation key has expired for this personal data request.' ) );
}
return true;
}
/**
* Returns the user request object for the specified request ID.
*
* @since 4.9.6
*
* @param int $request_id The ID of the user request.
* @return WP_User_Request|false
*/
function wp_get_user_request( $request_id ) {
$request_id = absint( $request_id );
$post = get_post( $request_id );
if ( ! $post || 'user_request' !== $post->post_type ) {
return false;
}
return new WP_User_Request( $post );
}
/**
* Checks if Application Passwords is supported.
*
* Application Passwords is supported only by sites using SSL or local environments
* but may be made available using the {@see 'wp_is_application_passwords_available'} filter.
*
* @since 5.9.0
*
* @return bool
*/
function wp_is_application_passwords_supported() {
return is_ssl() || 'local' === wp_get_environment_type();
}
/**
* Checks if Application Passwords is globally available.
*
* By default, Application Passwords is available to all sites using SSL or to local environments.
* Use the {@see 'wp_is_application_passwords_available'} filter to adjust its availability.
*
* @since 5.6.0
*
* @return bool
*/
function wp_is_application_passwords_available() {
/**
* Filters whether Application Passwords is available.
*
* @since 5.6.0
*
* @param bool $available True if available, false otherwise.
*/
return apply_filters( 'wp_is_application_passwords_available', wp_is_application_passwords_supported() );
}
/**
* Checks if Application Passwords is available for a specific user.
*
* By default all users can use Application Passwords. Use {@see 'wp_is_application_passwords_available_for_user'}
* to restrict availability to certain users.
*
* @since 5.6.0
*
* @param int|WP_User $user The user to check.
* @return bool
*/
function wp_is_application_passwords_available_for_user( $user ) {
if ( ! wp_is_application_passwords_available() ) {
return false;
}
if ( ! is_object( $user ) ) {
$user = get_userdata( $user );
}
if ( ! $user || ! $user->exists() ) {
return false;
}
/**
* Filters whether Application Passwords is available for a specific user.
*
* @since 5.6.0
*
* @param bool $available True if available, false otherwise.
* @param WP_User $user The user to check.
*/
return apply_filters( 'wp_is_application_passwords_available_for_user', true, $user );
}
/**
* Registers the user meta property for persisted preferences.
*
* This property is used to store user preferences across page reloads and is
* currently used by the block editor for preferences like 'fullscreenMode' and
* 'fixedToolbar'.
*
* @since 6.1.0
* @access private
*
* @global wpdb $wpdb WordPress database abstraction object.
*/
function wp_register_persisted_preferences_meta() {
/*
* Create a meta key that incorporates the blog prefix so that each site
* on a multisite can have distinct user preferences.
*/
global $wpdb;
$meta_key = $wpdb->get_blog_prefix() . 'persisted_preferences';
register_meta(
'user',
$meta_key,
array(
'type' => 'object',
'single' => true,
'show_in_rest' => array(
'name' => 'persisted_preferences',
'type' => 'object',
'schema' => array(
'type' => 'object',
'context' => array( 'edit' ),
'properties' => array(
'_modified' => array(
'description' => __( 'The date and time the preferences were updated.' ),
'type' => 'string',
'format' => 'date-time',
'readonly' => false,
),
),
'additionalProperties' => true,
),
),
)
);
}
/**
* Sets the last changed time for the 'users' cache group.
*
* @since 6.3.0
*/
function wp_cache_set_users_last_changed() {
wp_cache_set_last_changed( 'users' );
}
/**
* Checks if password reset is allowed for a specific user.
*
* @since 6.3.0
*
* @param int|WP_User $user The user to check.
* @return bool|WP_Error True if allowed, false or WP_Error otherwise.
*/
function wp_is_password_reset_allowed_for_user( $user ) {
if ( ! is_object( $user ) ) {
$user = get_userdata( $user );
}
if ( ! $user || ! $user->exists() ) {
return false;
}
$allow = true;
if ( is_multisite() && is_user_spammy( $user ) ) {
$allow = false;
}
/**
* Filters whether to allow a password to be reset.
*
* @since 2.7.0
*
* @param bool $allow Whether to allow the password to be reset. Default true.
* @param int $user_id The ID of the user attempting to reset a password.
*/
return apply_filters( 'allow_password_reset', $allow, $user->ID );
}