wp_authenticate_email_password( WP_User|WP_Error|null $user, string $email, string $password ): WP_User|WP_Error
- Since
- 4.5.0
- Source
wp-includes/user.php:242
Authenticates a user using the email and password.
Parameters
$userWP_User|WP_Error|null- WP_User or WP_Error object if a previous callback failed authentication.
$emailstring- Email address for authentication.
$passwordstring- Password for authentication.
Return
WP_User|WP_Error- WP_User on success, WP_Error on failure.
Hooks fired · 1
One hook fires while wp_authenticate_email_password() runs, in this order:
- apply_filters( wp_authenticate_user )filterline 285 (+43 into the body)
Filters whether the given user can be authenticated with the provided password.
Uses · 11
- is_wp_error()Checks whether the given variable is a WordPress Error.
- __()Retrieves the translation of $text.
- is_email()Verifies that an email is valid.
- get_user_by()Retrieves user info by a given field.
- apply_filters()Calls the callback functions that have been added to a filter hook.
- wp_check_password()Checks a plaintext password against a hashed password.
- esc_html()Escaping for HTML blocks.
- wp_lostpassword_url()Returns the URL that allows the user to reset the lost password.
- wp_password_needs_rehash()Checks whether a password hash needs to be rehashed.
- wp_set_password()Updates the user's password with a new hashed one.
- WP_Error::__construct()Initializes the error.
Source
function wp_authenticate_email_password( $user, $email, #[\SensitiveParameter] $password) { if ( $user instanceof WP_User ) { return $user; } if ( empty( $email ) || empty( $password ) ) { if ( is_wp_error( $user ) ) { return $user; } $error = new WP_Error(); if ( empty( $email ) ) { // Uses 'empty_username' for back-compat with wp_signon(). $error->add( 'empty_username', __( '<strong>Error:</strong> The email field is empty.' ) ); } if ( empty( $password ) ) { $error->add( 'empty_password', __( '<strong>Error:</strong> The password field is empty.' ) ); } return $error; } if ( ! is_email( $email ) ) { return $user; } $user = get_user_by( 'email', $email ); if ( ! $user ) { return new WP_Error( 'invalid_email', __( 'Unknown email address. Check again or try your username.' ) ); } /** This filter is documented in wp-includes/user.php */ $user = apply_filters( 'wp_authenticate_user', $user, $password ); if ( is_wp_error( $user ) ) { return $user; } $valid = wp_check_password( $password, $user->user_pass, $user->ID ); if ( ! $valid ) { return new WP_Error( 'incorrect_password', sprintf( /* translators: %s: Email address. */ __( '<strong>Error:</strong> The password you entered for the email address %s is incorrect.' ), '<strong>' . esc_html( $email ) . '</strong>' ) . ' <a href="' . wp_lostpassword_url() . '">' . __( 'Lost your password?' ) . '</a>' ); } if ( wp_password_needs_rehash( $user->user_pass, $user->ID ) ) { wp_set_password( $password, $user->ID ); } return $user;}History
Introduced in 4.5.0. Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
About this page
- Parsed data
- Generated from the wordpress-develop 7.1.0 tag, from
src/wp-includes/user.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it. - Corrections
- Something wrong on this page? Report it and it gets fixed in the next regeneration.