Users: Preserve early-authenticated user ID in determine_current_user filter chain

src/wp-includes/pluggable.php

@@ -774,12 +774,18 @@ function wp_logout() {
 	 *
 	 * @global int $login_grace_period
 	 *
-	 * @param string $cookie Optional. If used, will validate contents instead of cookie's.
-	 * @param string $scheme Optional. The cookie scheme to use: 'auth', 'secure_auth', or 'logged_in'.
+	 * @param int|string $cookie Optional. User ID if passed via 'determine_current_user' filter,
+	 *                           or cookie string to validate. Default empty string.
+	 * @param string     $scheme Optional. The cookie scheme to use: 'auth', 'secure_auth', or 'logged_in'.
 	 *                       Note: This does *not* default to 'auth' like other cookie functions.
-	 * @return int|false User ID if valid cookie, false if invalid.
+	 * @return int|false User ID if valid cookie, false if invalid. If a user ID from an earlier filter
+	 *                   callback is received, that value is returned.
 	 */
 	function wp_validate_auth_cookie( $cookie = '', $scheme = '' ) {
+		if ( $cookie && ( ! is_string( $cookie ) || is_numeric( $cookie ) ) ) {
+			return $cookie;
+		}
+
 		$cookie_elements = wp_parse_auth_cookie( $cookie, $scheme );
 		if ( ! $cookie_elements ) {
 			/**
@@ -2376,7 +2382,7 @@ function wp_new_user_notification( $user_id, $deprecated = null, $notify = '' )
 
 		$switched_locale = switch_to_user_locale( $user_id );
 
-		$message  = __( 'To set your password, visit the following address:' ) . "\r\n\r\n";
+		$message = __( 'To set your password, visit the following address:' ) . "\r\n\r\n";
 
 		/*
 		 * Since some user login names end in a period, this could produce ambiguous URLs that

tests/phpunit/tests/user/wpDetermineCurrentUser.php

@@ -0,0 +1,34 @@
+<?php
+
+/**
+ * Tests for the determine_current_user filter.
+ *
+ * @group user
+ * @group auth
+ *
+ * @covers ::wp_validate_auth_cookie
+ */
+class Tests_User_WpDetermineCurrentUser extends WP_UnitTestCase {
+
+	/**
+	 * Tests that determine_current_user filter callbacks with priority < 10 return their user ID
+	 * without being overridden by wp_validate_auth_cookie.
+	 *
+	 * @ticket 28212
+	 */
+	public function test_determine_current_user_early_filter_priority_less_than_10() {
+		$user_id = self::factory()->user->create();
+
+		$callback = function ( $current_user_id ) use ( $user_id ) {
+			return $user_id;
+		};
+
+		add_filter( 'determine_current_user', $callback, 5 );
+
+		$determined_user_id = apply_filters( 'determine_current_user', false );
+
+		remove_filter( 'determine_current_user', $callback, 5 );
+
+		$this->assertSame( $user_id, $determined_user_id );
+	}
+}