Users: Preserve early-authenticated user ID in determine_current_user filter chain

src/wp-includes/pluggable.php

@@ -774,12 +774,18 @@ function wp_logout() {
 	 *
 	 * @global int $login_grace_period
 	 *
-	 * @param string $cookie Optional. If used, will validate contents instead of cookie's.
-	 * @param string $scheme Optional. The cookie scheme to use: 'auth', 'secure_auth', or 'logged_in'.
+	 * @param int|string $cookie Optional. User ID if passed via 'determine_current_user' filter,
+	 *                           or cookie string to validate. Default empty string.
+	 * @param string     $scheme Optional. The cookie scheme to use: 'auth', 'secure_auth', or 'logged_in'.
 	 *                       Note: This does *not* default to 'auth' like other cookie functions.
-	 * @return int|false User ID if valid cookie, false if invalid.
+	 * @return int|false User ID if valid cookie, false if invalid. If a user ID from an earlier filter
+	 *                   callback is received, that value is returned.
 	 */
 	function wp_validate_auth_cookie( $cookie = '', $scheme = '' ) {
+		if ( $cookie && ( ! is_string( $cookie ) || is_numeric( $cookie ) ) ) {
+			return $cookie;
+		}
+
 		$cookie_elements = wp_parse_auth_cookie( $cookie, $scheme );
 		if ( ! $cookie_elements ) {
 			/**

tests/phpunit/tests/auth.php

@@ -95,7 +95,7 @@ public function test_auth_cookie_invalid() {
 		$cookie          = wp_generate_auth_cookie( self::$user_id, time() + 3600, 'auth' );
 		list($a, $b, $c) = explode( '|', $cookie );
 		$cookie          = $a . '|' . ( $b + 1 ) . '|' . $c;
-		$this->assertFalse( wp_validate_auth_cookie( self::$user_id, 'auth' ), 'altered cookie' );
+		$this->assertFalse( wp_validate_auth_cookie( $cookie, 'auth' ), 'altered cookie' );
 	}
 
 	public function test_auth_cookie_scheme() {

tests/phpunit/tests/user/wpDetermineCurrentUser.php

@@ -0,0 +1,34 @@
+<?php
+
+/**
+ * Tests for the determine_current_user filter.
+ *
+ * @group user
+ * @group auth
+ *
+ * @covers ::wp_validate_auth_cookie
+ */
+class Tests_User_WpDetermineCurrentUser extends WP_UnitTestCase {
+
+	/**
+	 * Tests that determine_current_user filter callbacks with priority < 10 return their user ID
+	 * without being overridden by wp_validate_auth_cookie.
+	 *
+	 * @ticket 28212
+	 */
+	public function test_determine_current_user_early_filter_priority_less_than_10() {
+		$user_id = self::factory()->user->create();
+
+		$callback = function ( $current_user_id ) use ( $user_id ) {
+			return $user_id;
+		};
+
+		add_filter( 'determine_current_user', $callback, 5 );
+
+		$determined_user_id = apply_filters( 'determine_current_user', false );
+
+		remove_filter( 'determine_current_user', $callback, 5 );
+
+		$this->assertSame( $user_id, $determined_user_id );
+	}
+}