From bcb4a1f7297e2675514604a1afe102fbdf613edf Mon Sep 17 00:00:00 2001 From: Himanshu Pathak Date: Fri, 31 Jul 2026 16:51:41 +0530 Subject: [PATCH 1/5] Ensure `wp_validate_auth_cookie` respects user IDs returned by early `determine_current_user` filters --- src/wp-includes/pluggable.php | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/wp-includes/pluggable.php b/src/wp-includes/pluggable.php index b283844836b83..c4a98775e344e 100644 --- a/src/wp-includes/pluggable.php +++ b/src/wp-includes/pluggable.php @@ -774,12 +774,18 @@ function wp_logout() { * * @global int $login_grace_period * - * @param string $cookie Optional. If used, will validate contents instead of cookie's. - * @param string $scheme Optional. The cookie scheme to use: 'auth', 'secure_auth', or 'logged_in'. + * @param int|string $cookie Optional. User ID if passed via `determine_current_user` filter, + * or cookie string to validate. Default empty string. + * @param string $scheme Optional. The cookie scheme to use: 'auth', 'secure_auth', or 'logged_in'. * Note: This does *not* default to 'auth' like other cookie functions. - * @return int|false User ID if valid cookie, false if invalid. + * @return int|false User ID if valid cookie, false if invalid. If a user ID from an earlier filter + * callback is received, that value is returned. */ function wp_validate_auth_cookie( $cookie = '', $scheme = '' ) { + if ( $cookie && ( ! is_string( $cookie ) || is_numeric( $cookie ) ) ) { + return $cookie; + } + $cookie_elements = wp_parse_auth_cookie( $cookie, $scheme ); if ( ! $cookie_elements ) { /** From 61c528921dc55e432f016f8ef30d8f0d1ddf5806 Mon Sep 17 00:00:00 2001 From: Himanshu Pathak Date: Fri, 31 Jul 2026 16:52:46 +0530 Subject: [PATCH 2/5] Fix doc comment --- src/wp-includes/pluggable.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wp-includes/pluggable.php b/src/wp-includes/pluggable.php index c4a98775e344e..e7b20a30afc06 100644 --- a/src/wp-includes/pluggable.php +++ b/src/wp-includes/pluggable.php @@ -774,7 +774,7 @@ function wp_logout() { * * @global int $login_grace_period * - * @param int|string $cookie Optional. User ID if passed via `determine_current_user` filter, + * @param int|string $cookie Optional. User ID if passed via 'determine_current_user' filter, * or cookie string to validate. Default empty string. * @param string $scheme Optional. The cookie scheme to use: 'auth', 'secure_auth', or 'logged_in'. * Note: This does *not* default to 'auth' like other cookie functions. From 03381b3d0c0a96fa69b7fc1b10c35b8c11bd62bb Mon Sep 17 00:00:00 2001 From: Himanshu Pathak Date: Fri, 31 Jul 2026 16:55:34 +0530 Subject: [PATCH 3/5] Tests: Add unit test for `determine_current_user` filter priority behavior --- .../tests/user/wpDetermineCurrentUser.php | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 tests/phpunit/tests/user/wpDetermineCurrentUser.php diff --git a/tests/phpunit/tests/user/wpDetermineCurrentUser.php b/tests/phpunit/tests/user/wpDetermineCurrentUser.php new file mode 100644 index 0000000000000..99f6f8ba86bc4 --- /dev/null +++ b/tests/phpunit/tests/user/wpDetermineCurrentUser.php @@ -0,0 +1,34 @@ +user->create(); + + $callback = function( $current_user_id ) use ( $user_id ) { + return $user_id; + }; + + add_filter( 'determine_current_user', $callback, 5 ); + + $determined_user_id = apply_filters( 'determine_current_user', false ); + + remove_filter( 'determine_current_user', $callback, 5 ); + + $this->assertSame( $user_id, $determined_user_id ); + } +} From 46612e72c1f39f14f7de0885c536ee3695bf1dfe Mon Sep 17 00:00:00 2001 From: Himanshu Pathak Date: Fri, 31 Jul 2026 16:59:32 +0530 Subject: [PATCH 4/5] Fix linting issues in tests --- tests/phpunit/tests/user/wpDetermineCurrentUser.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/phpunit/tests/user/wpDetermineCurrentUser.php b/tests/phpunit/tests/user/wpDetermineCurrentUser.php index 99f6f8ba86bc4..eb302f85270ed 100644 --- a/tests/phpunit/tests/user/wpDetermineCurrentUser.php +++ b/tests/phpunit/tests/user/wpDetermineCurrentUser.php @@ -19,7 +19,7 @@ class Tests_User_WpDetermineCurrentUser extends WP_UnitTestCase { public function test_determine_current_user_early_filter_priority_less_than_10() { $user_id = self::factory()->user->create(); - $callback = function( $current_user_id ) use ( $user_id ) { + $callback = function ( $current_user_id ) use ( $user_id ) { return $user_id; }; From ed7f105acba6ee3f35780fe319b15a01b1a5fffd Mon Sep 17 00:00:00 2001 From: Himanshu Pathak Date: Mon, 10 Aug 2026 16:54:55 +0530 Subject: [PATCH 5/5] Tests: Fix incorrect argument in test_auth_cookie_invalid altered cookie assertion --- tests/phpunit/tests/auth.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/phpunit/tests/auth.php b/tests/phpunit/tests/auth.php index a290d11e118e6..f4c390001674a 100644 --- a/tests/phpunit/tests/auth.php +++ b/tests/phpunit/tests/auth.php @@ -95,7 +95,7 @@ public function test_auth_cookie_invalid() { $cookie = wp_generate_auth_cookie( self::$user_id, time() + 3600, 'auth' ); list($a, $b, $c) = explode( '|', $cookie ); $cookie = $a . '|' . ( $b + 1 ) . '|' . $c; - $this->assertFalse( wp_validate_auth_cookie( self::$user_id, 'auth' ), 'altered cookie' ); + $this->assertFalse( wp_validate_auth_cookie( $cookie, 'auth' ), 'altered cookie' ); } public function test_auth_cookie_scheme() {