Make use of get_password_reset_key() in reset_password() method

Great plugin, saved me a great deal of pain.

Experienced buggy behaviour when I tried to reset the password through the WP REST api callback, the reset key was never updating and it was stuck in the same corrupt key. Much needed logic that was in your reset_password() method already exists in the core function: get_password_reset_key() - The function was added in WP 4.4 and should be safe to use I believe. (Depending on which WP versions you are supporting)

Feel free to use/test my modified method below:

/**
 * Endpoint for requesting a password reset link.
 * This is a slightly modified version of what WP core uses.
 *
 * @param object $request The request object that come in from WP Rest API.
 * @since 1.0
 */
public function reset_password( $request ) {
    $username = $request->get_param( 'username' );
    if ( ! $username ) {
        return array(
            'code' => 'jwt_auth_invalid_username',
            'message' => __( '<strong>Error:</strong> Username or email not specified.', 'simple-jwt-authentication' ),
            'data' => array(
                'status' => 403,
            ),
        );
    } elseif ( strpos( $username, '@' ) ) {
        $user_data = get_user_by( 'email', trim( $username ) );
    } else {
        $user_data = get_user_by( 'login', trim( $username ) );
    }

    global $wpdb, $current_site;

    do_action( 'lostpassword_post' );
    if ( ! $user_data ) {
        return array(
            'code' => 'jwt_auth_invalid_username',
            'message' => __( '<strong>Error:</strong> Invalid username.', 'simple-jwt-authentication' ),
            'data' => array(
                'status' => 403,
            ),
        );
    }

    // redefining user_login ensures we return the right case in the email
    $user_login = $user_data->user_login;
    $user_email = $user_data->user_email;

    $key = get_password_reset_key( $user_data );

    // Some simple error management
    if( is_wp_error( $key ) || !$key ){

        $default_err_response = array(
            'code' => 'jwt_auth_reset_password_not_allowed',
            'message' => __( '<strong>Error:</strong> Resetting password is not allowed.', 'simple-jwt-authentication' ),
            'data' => array(
                'status' => 403,
            )
        );

        // Check for "falsy" results, no WP_Error objects
        if( !is_wp_error( $key ) && !$key ){
            return $default_err_response;
        }

        // Get the error code
        $error_code = $key->get_error_code();

        // Lets check for some normal error messages you might recieve from get_password_reset_key() function
        if( $error_code === 'no_password_reset' ){
            // Check if resetting the password for the user is allowed
            return $default_err_response;
        }elseif( $error_code === 'no_password_key_update' ){
            // Failed to update the reset key to the database
            return array(
                'code' => 'jwt_auth_reset_password_no_password_key_update',
                'message' => __( '<strong>Error:</strong> Could not save password reset key to database.', 'simple-jwt-authentication' ),
                'data' => array(
                    'status' => 403,
                )
            );
        }else{
            // Fallback error, maybe WP added an new error code that we do not support...
            return $default_err_response;
        }
    }

    $message = __( 'Someone requested that the password be reset for the following account:' ) . "\r\n\r\n";
    $message .= network_home_url( '/' ) . "\r\n\r\n";
    $message .= sprintf( __( 'Username: %s' ), $user_login ) . "\r\n\r\n";
    $message .= __( 'If this was a mistake, just ignore this email and nothing will happen.' ) . "\r\n\r\n";
    $message .= __( 'To reset your password, visit the following address:' ) . "\r\n\r\n";
    $message .= '<' . network_site_url( "wp-login.php?action=rp&key=$key&login=" . rawurlencode( $user_login ), 'login' ) . ">\r\n";

    if ( is_multisite() ) {
        $blogname = $GLOBALS['current_site']->site_name;
    } else {
        // The blogname option is escaped with esc_html on the way into the database in sanitize_option
        // we want to reverse this for the plain text arena of emails.
        $blogname = wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES );
    }

    $title = sprintf( __( '[%s] Password Reset' ), $blogname );

    $title = apply_filters( 'retrieve_password_title', $title );
    $message = apply_filters( 'retrieve_password_message', $message, $key );

    if ( $message && ! wp_mail( $user_email, $title, $message ) ) {
        wp_die( __( 'The e-mail could not be sent.' ) . "<br />\n" . __( 'Possible reason: your host may have disabled the mail() function...' ) );
    }

    return array(
        'code' => 'jwt_auth_password_reset',
        'message' => __( '<strong>Success:</strong> an email for selecting a new password has been sent.', 'simple-jwt-authentication' ),
        'data' => array(
            'status' => 200,
        ),
    );
}

jonathan-dejong / simple-jwt-authentication

Make use of get_password_reset_key() in reset_password() method #23