Custom Reset Password Page

Upon checking the value of $_COOKIE['wp-resetpass-'.COOKIEHASH] it says;
Notice: Undefined index: wp-resetpass-3307b20d0f1aa2f65f1a8220dac0acfc in ...

The COOKIEHASH however has a value. It looks like the cookie for wp-resetpass is failed to set or it is being destroyed before loading the page.

Maybe setting the value of $_COOKIE['wp-resetpass-'.COOKIEHASH] will fix the issue, but I don’t know what is the value of it or how you set it.

• This reply was modified 4 years, 8 months ago by panda.

So I managed to fix it all, I just need to set the reset password cookie again.

$value = sprintf( "%s:%s", wp_unslash( $_GET[ 'id' ] ), wp_unslash( $_GET[ 'key' ] ) );
WC_Shortcode_My_Account::set_reset_password_cookie( $value );

Here’s the whole code.

//Create shortcode for lost password form [lost_password_form]
function wc_custom_lost_password_form( $atts ) {
	if ( !empty( $_COOKIE[ "csx-reset-link-set" ] ) && isset( $_COOKIE[ "csx-reset-link-set" ] ) && $_COOKIE[ "csx-reset-link-set" ] === "true" ) { // WPCS: input var ok, CSRF ok.
		return wc_get_template( 'myaccount/lost-password-confirmation.php' );
	} elseif ( !empty( $_SESSION[ "csx-show-reset-form" ] ) && isset( $_SESSION[ "csx-show-reset-form" ] ) && $_SESSION[ "csx-show-reset-form" ] === "true" ) {
		$rp_id = $_SESSION[ "csx-id" ];
		$rp_key = $_SESSION[ "csx-key" ];
		if ( isset( $_COOKIE[ 'wp-resetpass-' . COOKIEHASH ] ) && 0 < strpos( $_COOKIE[ 'wp-resetpass-' . COOKIEHASH ], ':' ) ) { // @codingStandardsIgnoreLine
			list( $rp_id, $rp_key ) = array_map( 'wc_clean', explode( ':', wp_unslash( $_COOKIE[ 'wp-resetpass-' . COOKIEHASH ] ), 2 ) ); // @codingStandardsIgnoreLine
			$userdata = get_userdata( absint( $rp_id ) );
			$rp_login = $userdata ? $userdata->user_login : '';
			$user = WC_Shortcode_My_Account::check_password_reset_key( $rp_key, $rp_login );

			// Reset key / login is correct, display reset password form with hidden key / login values.
			if ( is_object( $user ) ) {
				return wc_get_template(
					'myaccount/form-reset-password.php',
					array(
						'key' => $rp_key,
						'login' => $rp_login,
					)
				);
			}
		}
	}

	// Show lost password form by default.
	return wc_get_template(
		'myaccount/form-lost-password.php',
		array(
			'form' => 'lost_password',
		)
	);
}
add_shortcode( 'lost_password_form', 'wc_custom_lost_password_form' );

//Handling query
function csx_process_query() {

	if ( isset( $_GET[ 'reset-link-sent' ] ) && $_GET[ 'reset-link-sent' ] === "true" ) {
		setcookie( 'csx-reset-link-set', "true", time() + ( 300 * 1 ), "/" ); //Allow to submit email for reset after 5 minutes only.
		unset( $_SESSION[ "csx-show-reset-form" ] );
	}

	if ( isset( $_GET[ 'show-reset-form' ] ) && $_GET[ 'show-reset-form' ] === "true" ||
		isset( $_GET[ 'key' ] ) && isset( $_GET[ 'id' ] ) ) {
		$_SESSION[ "csx-show-reset-form" ] = "true";
		setcookie( 'csx-reset-link-set', "", time() - 3600, "/" );
	}

	//Set session and cookie if key and id are existed
	if ( isset( $_GET[ 'key' ] ) && isset( $_GET[ 'id' ] ) ) {
		$_SESSION[ "csx-key" ] = $_GET[ 'key' ];
		$_SESSION[ "csx-id" ] = $_GET[ 'id' ];

		$value = sprintf( "%s:%s", wp_unslash( $_GET[ 'id' ] ), wp_unslash( $_GET[ 'key' ] ) );
		WC_Shortcode_My_Account::set_reset_password_cookie( $value );
	}

	//Unset session and cookie after successfully changed the password.
	if ( isset( $_GET[ 'new-password-created' ] ) && $_GET[ 'new-password-created' ] === "true" ) {
		setcookie( 'wp-resetpass-' . COOKIEHASH, "", time() - 3600 );
		unset( $_SESSION[ "csx-show-reset-form" ] );
		unset( $_SESSION[ "csx-reset-link-set" ] );
		unset( $_SESSION[ "csx-id" ] );
		unset( $_SESSION[ "csx-key" ] );
	}
}
add_action( 'init', 'csx_process_query' );

//Redirect to custom lost password on request
function csx_redirections() {
	if ( isset( $_GET[ 'reset-link-sent' ] ) || isset( $_GET[ 'show-reset-form' ] ) ||
		isset( $_GET[ 'key' ] ) && isset( $_GET[ 'id' ] ) ) {
		wp_redirect( home_url() . '/password-recovery' );
		exit;
	}
}
add_action( 'template_redirect', 'csx_redirections' );

//Replace the default URL from lost password
function wdm_lostpassword_url() {
	return site_url( '/password-recovery' );
}
add_filter( 'lostpassword_url', 'wdm_lostpassword_url', 10, 0 );

//Redirect to login page with success notice after successful password reset.
function woocommerce_new_pass_redirect( $user ) {
	wc_add_notice( __( 'Your password has been changed successfully! Please login to continue.', 'woocommerce' ), 'success' );
	wp_redirect( home_url() . "/sign-in/?new-password-created=true" );
	exit;
}
add_action( 'woocommerce_customer_reset_password', 'woocommerce_new_pass_redirect' );

Now I can just use the ShortCode [lost_password_form] on any page and set the default URL for lost password.

Also, I’ve changed the URL in the email message. Here’s how I did it.

Anyway, I’m still a little bit skeptical about my solution, feels like not right.

The support is very poor responding to queries.