W3cubDocs

/WordPress

wp_validate_user_request_key( string $request_id, string $key )

Validate a user request by comparing the key with the request’s key.

Parameters

$request_id

(string) (Required) ID of the request being confirmed.

$key

(string) (Required) Provided key to validate.

Return

(bool|WP_Error) True on success, WP_Error on failure.

Source

File: wp-includes/user.php 

function wp_validate_user_request_key( $request_id, $key ) {
	global $wp_hasher;

	$request_id = absint( $request_id );
	$request    = wp_get_user_request( $request_id );

	if ( ! $request ) {
		return new WP_Error( 'invalid_request', __( 'Invalid request.' ) );
	}

	if ( ! in_array( $request->status, array( 'request-pending', 'request-failed' ), true ) ) {
		return new WP_Error( 'expired_link', __( 'This link has expired.' ) );
	}

	if ( empty( $key ) ) {
		return new WP_Error( 'missing_key', __( 'Missing confirm key.' ) );
	}

	if ( empty( $wp_hasher ) ) {
		require_once ABSPATH . WPINC . '/class-phpass.php';
		$wp_hasher = new PasswordHash( 8, true );
	}

	$key_request_time = $request->modified_timestamp;
	$saved_key        = $request->confirm_key;

	if ( ! $saved_key ) {
		return new WP_Error( 'invalid_key', __( 'Invalid key.' ) );
	}

	if ( ! $key_request_time ) {
		return new WP_Error( 'invalid_key', __( 'Invalid action.' ) );
	}

	/**
	 * Filters the expiration time of confirm keys.
	 *
	 * @since 4.9.6
	 *
	 * @param int $expiration The expiration time in seconds.
	 */
	$expiration_duration = (int) apply_filters( 'user_request_key_expiration', DAY_IN_SECONDS );
	$expiration_time     = $key_request_time + $expiration_duration;

	if ( ! $wp_hasher->CheckPassword( $key, $saved_key ) ) {
		return new WP_Error( 'invalid_key', __( 'Invalid key.' ) );
	}

	if ( ! $expiration_time || time() > $expiration_time ) {
		return new WP_Error( 'expired_key', __( 'The confirmation email has expired.' ) );
	}

	return true;
}

Uses

Uses Description
wp-includes/user.php: wp_get_user_request()

Return the user request object for the specified request ID.
wp-includes/user.php: user_request_key_expiration

Filters the expiration time of confirm keys.
wp-includes/l10n.php: __()

Retrieve the translation of $text.
wp-includes/functions.php: absint()

Convert a value to non-negative integer.
wp-includes/plugin.php: apply_filters()

Calls the callback functions that have been added to a filter hook.
wp-includes/class-wp-error.php: WP_Error::__construct()

Initialize the error.

Changelog

Version Description
4.9.6 Introduced.

© 2003–2019 WordPress Foundation
Licensed under the GNU GPLv2+ License.
https://developer.wordpress.org/reference/functions/wp_validate_user_request_key