Hi,
We're seeing an issue with the password reset future:
- ultimate-member v2.9.1
- um-set-password v1.0.2
When users reset password, a success message is shown, but the user is not actually approved.
It appears that a set_pass=new_user parameter is NOT the URL nor in any hidden inputs, so it's unavailable in $_REQUEST on
|
if ( isset( $_REQUEST['set_pass'] ) && 'new_user' === sanitize_key( $_REQUEST['set_pass'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended |
Hi,
We're seeing an issue with the password reset future:
When users reset password, a success message is shown, but the user is not actually approved.
It appears that a set_pass=new_user parameter is NOT the URL nor in any hidden inputs, so it's unavailable in
$_REQUESTonExtended/src/um-set-password/src/Core.php
Line 94 in f1fec51