From 87202412fe746c32997ec9f2b98f350265cf17d8 Mon Sep 17 00:00:00 2001 From: Himanshu Pathak Date: Fri, 31 Jul 2026 16:51:41 +0530 Subject: [PATCH 1/5] Ensure `wp_validate_auth_cookie` respects user IDs returned by early `determine_current_user` filters --- src/wp-includes/pluggable.php | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/wp-includes/pluggable.php b/src/wp-includes/pluggable.php index e1c43540c8cb8..6dfd71e71fb07 100644 --- a/src/wp-includes/pluggable.php +++ b/src/wp-includes/pluggable.php @@ -774,12 +774,18 @@ function wp_logout() { * * @global int $login_grace_period * - * @param string $cookie Optional. If used, will validate contents instead of cookie's. - * @param string $scheme Optional. The cookie scheme to use: 'auth', 'secure_auth', or 'logged_in'. + * @param int|string $cookie Optional. User ID if passed via `determine_current_user` filter, + * or cookie string to validate. Default empty string. + * @param string $scheme Optional. The cookie scheme to use: 'auth', 'secure_auth', or 'logged_in'. * Note: This does *not* default to 'auth' like other cookie functions. - * @return int|false User ID if valid cookie, false if invalid. + * @return int|false User ID if valid cookie, false if invalid. If a user ID from an earlier filter + * callback is received, that value is returned. */ function wp_validate_auth_cookie( $cookie = '', $scheme = '' ) { + if ( $cookie && ( ! is_string( $cookie ) || is_numeric( $cookie ) ) ) { + return $cookie; + } + $cookie_elements = wp_parse_auth_cookie( $cookie, $scheme ); if ( ! $cookie_elements ) { /** From c830a4b017610b1c73f5a359785d1564a86c5197 Mon Sep 17 00:00:00 2001 From: Himanshu Pathak Date: Fri, 31 Jul 2026 16:52:46 +0530 Subject: [PATCH 2/5] Fix doc comment --- src/wp-includes/pluggable.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wp-includes/pluggable.php b/src/wp-includes/pluggable.php index 6dfd71e71fb07..ea82acc04f15a 100644 --- a/src/wp-includes/pluggable.php +++ b/src/wp-includes/pluggable.php @@ -774,7 +774,7 @@ function wp_logout() { * * @global int $login_grace_period * - * @param int|string $cookie Optional. User ID if passed via `determine_current_user` filter, + * @param int|string $cookie Optional. User ID if passed via 'determine_current_user' filter, * or cookie string to validate. Default empty string. * @param string $scheme Optional. The cookie scheme to use: 'auth', 'secure_auth', or 'logged_in'. * Note: This does *not* default to 'auth' like other cookie functions. From a246b7ae75616f24d1b936556acb0f765c7bd993 Mon Sep 17 00:00:00 2001 From: Himanshu Pathak Date: Fri, 31 Jul 2026 16:55:34 +0530 Subject: [PATCH 3/5] Tests: Add unit test for `determine_current_user` filter priority behavior --- .../tests/user/wpDetermineCurrentUser.php | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 tests/phpunit/tests/user/wpDetermineCurrentUser.php diff --git a/tests/phpunit/tests/user/wpDetermineCurrentUser.php b/tests/phpunit/tests/user/wpDetermineCurrentUser.php new file mode 100644 index 0000000000000..99f6f8ba86bc4 --- /dev/null +++ b/tests/phpunit/tests/user/wpDetermineCurrentUser.php @@ -0,0 +1,34 @@ +user->create(); + + $callback = function( $current_user_id ) use ( $user_id ) { + return $user_id; + }; + + add_filter( 'determine_current_user', $callback, 5 ); + + $determined_user_id = apply_filters( 'determine_current_user', false ); + + remove_filter( 'determine_current_user', $callback, 5 ); + + $this->assertSame( $user_id, $determined_user_id ); + } +} From cf0ea33eb2c7283d15bdf4ea34ffb479e4ab44e7 Mon Sep 17 00:00:00 2001 From: Himanshu Pathak Date: Fri, 31 Jul 2026 16:58:59 +0530 Subject: [PATCH 4/5] Fix linting --- src/wp-includes/pluggable.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wp-includes/pluggable.php b/src/wp-includes/pluggable.php index ea82acc04f15a..660ad82d8d679 100644 --- a/src/wp-includes/pluggable.php +++ b/src/wp-includes/pluggable.php @@ -2382,7 +2382,7 @@ function wp_new_user_notification( $user_id, $deprecated = null, $notify = '' ) $switched_locale = switch_to_user_locale( $user_id ); - $message = __( 'To set your password, visit the following address:' ) . "\r\n\r\n"; + $message = __( 'To set your password, visit the following address:' ) . "\r\n\r\n"; /* * Since some user login names end in a period, this could produce ambiguous URLs that From 2200fcd5a5d0b21009d5e9d129d522389954d80f Mon Sep 17 00:00:00 2001 From: Himanshu Pathak Date: Fri, 31 Jul 2026 16:59:32 +0530 Subject: [PATCH 5/5] Fix linting issues in tests --- tests/phpunit/tests/user/wpDetermineCurrentUser.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/phpunit/tests/user/wpDetermineCurrentUser.php b/tests/phpunit/tests/user/wpDetermineCurrentUser.php index 99f6f8ba86bc4..eb302f85270ed 100644 --- a/tests/phpunit/tests/user/wpDetermineCurrentUser.php +++ b/tests/phpunit/tests/user/wpDetermineCurrentUser.php @@ -19,7 +19,7 @@ class Tests_User_WpDetermineCurrentUser extends WP_UnitTestCase { public function test_determine_current_user_early_filter_priority_less_than_10() { $user_id = self::factory()->user->create(); - $callback = function( $current_user_id ) use ( $user_id ) { + $callback = function ( $current_user_id ) use ( $user_id ) { return $user_id; };