[wp-trac] [WordPress Trac] #32429: Password reset links should expire

[WordPress Trac]

#32429: Password reset links should expire
--------------------------+--------------------------
 Reporter:  markjaquith   |       Owner:  markjaquith
     Type:  defect (bug)  |      Status:  reviewing
 Priority:  normal        |   Milestone:  4.3
Component:  Security      |     Version:
 Severity:  normal        |  Resolution:
 Keywords:  has-patch     |     Focuses:
--------------------------+--------------------------

Comment (by dd32):

 [attachment:32429.8.diff 32429.8.diff] only runs
 `password_reset_key_expired` when an old-style key is presented (plain-
 text, or no $expiration specified)
 [attachment:32429.7.diff 32429.7.diff] runs `password_reset_key_expired`
 when the key has expired (ie. $expiration < time(), in addition to plain-
 text or no $expiration)

 I'm unsure which is the correct angle to take here, the filter name
 suggests the latter (7), but the docs and parameters suggest the former
 (8).

--
Ticket URL: <https://core.trac.wordpress.org/ticket/32429#comment:26>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform