WC_Shortcode_My_Account
in package
Shortcode my account class.
Table of Contents
- PASSWORD_RESET_BRIDGE_EXPIRATION = 10 * MINUTE_IN_SECONDS
- Password-reset bridge lifetime in seconds.
- PASSWORD_RESET_BRIDGE_HANDLE_LENGTH = 32
- Character length of a password-reset bridge handle.
- PASSWORD_RESET_BRIDGE_TRANSIENT_PREFIX = 'wc_password_reset_bridge_'
- Prefix for transient keys containing short-lived password-reset bridge state.
- PASSWORD_RESET_FORM_TOKEN_VERSION = 'wc1'
- Signed password-reset form token version.
- add_payment_method() : mixed
- Show the add payment method page.
- check_password_reset_key() : WP_User|bool
- Retrieves a user row based on password reset key and login.
- edit_account() : mixed
- Edit account details page.
- edit_address() : mixed
- Edit address page.
- get() : string
- Get the shortcode content.
- lost_password() : mixed
- Lost password page handling.
- output() : mixed
- Output the shortcode.
- reset_password() : mixed
- Handles resetting the user's password.
- retrieve_password() : bool
- Handles sending password retrieval email to customer.
- set_reset_password_cookie() : mixed
- Set or unset the cookie.
- view_order() : mixed
- View order page.
- add_password_reset_key_error_notice() : void
- Add the standard invalid password-reset key notice.
- consume_password_reset_bridge_token() : array{key: string, login: string}|false
- Consume a URL bridge handle and exchange it for signed form credentials.
- create_password_reset_form_token() : string
- Create the signed token submitted by the reset-password form.
- discard_password_reset_bridge_token() : void
- Delete a bridge handle without exchanging it, so it cannot be replayed.
- get_eligible_password_reset_user() : WP_User|false
- Resolve the user a bridge claim refers to, while the reset state and the viewer still allow it.
- get_password_reset_bridge_signature() : string
- Sign bridge claims together with WordPress's current hashed reset state.
- get_password_reset_bridge_transient_name() : string
- Get the transient name for a bridge handle without storing the raw handle.
- get_password_reset_bridge_user() : WP_User|false
- Resolve and validate a signed password-reset bridge token.
- get_password_reset_state_expiration() : int
- Get the current WordPress expiration for a user's hashed reset state.
- get_password_reset_state_signature() : string
- Sign the reset state persisted in the short-lived bridge payload.
- get_posted_password_reset_bridge_credentials() : array{key: string, login: string}|false
- Recover validated form credentials after password validation leaves the POST in place.
- my_account() : mixed
- My account page.
- my_account_add_notices() : mixed
- Add notices to the my account page.
- sign_password_reset_claims() : string
- Sign password-reset bridge claims with the site's nonce salt.
Constants
PASSWORD_RESET_BRIDGE_EXPIRATION
Password-reset bridge lifetime in seconds.
private
mixed
PASSWORD_RESET_BRIDGE_EXPIRATION
= 10 * MINUTE_IN_SECONDS
PASSWORD_RESET_BRIDGE_HANDLE_LENGTH
Character length of a password-reset bridge handle.
private
mixed
PASSWORD_RESET_BRIDGE_HANDLE_LENGTH
= 32
PASSWORD_RESET_BRIDGE_TRANSIENT_PREFIX
Prefix for transient keys containing short-lived password-reset bridge state.
private
mixed
PASSWORD_RESET_BRIDGE_TRANSIENT_PREFIX
= 'wc_password_reset_bridge_'
PASSWORD_RESET_FORM_TOKEN_VERSION
Signed password-reset form token version.
private
mixed
PASSWORD_RESET_FORM_TOKEN_VERSION
= 'wc1'
Methods
add_payment_method()
Show the add payment method page.
public
static add_payment_method() : mixed
Return values
mixed —check_password_reset_key()
Retrieves a user row based on password reset key and login.
public
static check_password_reset_key(string $key, string $login) : WP_User|bool
Since 11.2.0 the key may also be a signed WooCommerce reset-form token, which is what the
reset form carries when the WordPress reset cookie did not survive the click from the email
client. Both formats are accepted so that anything reading the key handed to
myaccount/form-reset-password.php keeps validating through this method.
Parameters
- $key : string
-
WordPress password reset key, or a signed WooCommerce reset-form token.
- $login : string
-
The user login.
Tags
Return values
WP_User|bool — User's database row on success, false for invalid keysedit_account()
Edit account details page.
public
static edit_account() : mixed
Return values
mixed —edit_address()
Edit address page.
public
static edit_address([string $load_address = 'billing' ]) : mixed
Parameters
- $load_address : string = 'billing'
-
Type of address; 'billing' or 'shipping'.
Return values
mixed —get()
Get the shortcode content.
public
static get(array<string|int, mixed> $atts) : string
Parameters
- $atts : array<string|int, mixed>
-
Shortcode attributes.
Return values
string —lost_password()
Lost password page handling.
public
static lost_password() : mixed
Return values
mixed —output()
Output the shortcode.
public
static output(array<string|int, mixed> $atts) : mixed
Parameters
- $atts : array<string|int, mixed>
-
Shortcode attributes.
Return values
mixed —reset_password()
Handles resetting the user's password.
public
static reset_password(WP_User $user, string $new_pass) : mixed
Parameters
- $user : WP_User
-
The user.
- $new_pass : string
-
New password for the user in plaintext.
Tags
Return values
mixed —retrieve_password()
Handles sending password retrieval email to customer.
public
static retrieve_password() : bool
Based on retrieve_password() in core wp-login.php.
Tags
Return values
bool — True: when finish. False: on errorset_reset_password_cookie()
Set or unset the cookie.
public
static set_reset_password_cookie([string $value = '' ]) : mixed
Parameters
- $value : string = ''
-
Cookie value.
Return values
mixed —view_order()
View order page.
public
static view_order(int $order_id) : mixed
Parameters
- $order_id : int
-
Order ID.
Return values
mixed —add_password_reset_key_error_notice()
Add the standard invalid password-reset key notice.
private
static add_password_reset_key_error_notice() : void
Return values
void —consume_password_reset_bridge_token()
Consume a URL bridge handle and exchange it for signed form credentials.
private
static consume_password_reset_bridge_token(mixed $handle) : array{key: string, login: string}|false
Parameters
- $handle : mixed
-
URL bridge handle.
Return values
array{key: string, login: string}|false — Form credentials on success, false otherwise.create_password_reset_form_token()
Create the signed token submitted by the reset-password form.
private
static create_password_reset_form_token(WP_User $user, int $expiration) : string
Parameters
- $user : WP_User
-
Token owner.
- $expiration : int
-
Unix expiry timestamp.
Return values
string — Signed form token.discard_password_reset_bridge_token()
Delete a bridge handle without exchanging it, so it cannot be replayed.
private
static discard_password_reset_bridge_token(mixed $handle) : void
Parameters
- $handle : mixed
-
URL bridge handle.
Return values
void —get_eligible_password_reset_user()
Resolve the user a bridge claim refers to, while the reset state and the viewer still allow it.
private
static get_eligible_password_reset_user(int $user_id, int $expiration[, string $login = '' ]) : WP_User|false
Parameters
- $user_id : int
-
Claimed user ID.
- $expiration : int
-
Claimed Unix expiry timestamp.
- $login : string = ''
-
Optional login the claim must match.
Return values
WP_User|false — User on success, false otherwise.get_password_reset_bridge_signature()
Sign bridge claims together with WordPress's current hashed reset state.
private
static get_password_reset_bridge_signature(WP_User $user, int $expiration, string $nonce) : string
Parameters
- $user : WP_User
-
Token owner.
- $expiration : int
-
Unix expiry timestamp.
- $nonce : string
-
Random token nonce.
Return values
string — HMAC signature.get_password_reset_bridge_transient_name()
Get the transient name for a bridge handle without storing the raw handle.
private
static get_password_reset_bridge_transient_name(string $handle) : string
Parameters
- $handle : string
-
URL bridge handle.
Return values
string — Transient name.get_password_reset_bridge_user()
Resolve and validate a signed password-reset bridge token.
private
static get_password_reset_bridge_user(string $token[, string $login = '' ]) : WP_User|false
Parameters
- $token : string
-
Signed bridge token.
- $login : string = ''
-
Optional login to bind during form submission.
Return values
WP_User|false — User on success, false otherwise.get_password_reset_state_expiration()
Get the current WordPress expiration for a user's hashed reset state.
private
static get_password_reset_state_expiration(WP_User $user) : int
Old-style activation keys do not carry a request timestamp. WordPress may still accept those through the password_reset_key_expired filter, so the bridge's own short expiry remains the limit for that compatibility path.
Parameters
- $user : WP_User
-
Token owner.
Return values
int — Unix expiry timestamp.get_password_reset_state_signature()
Sign the reset state persisted in the short-lived bridge payload.
private
static get_password_reset_state_signature(WP_User $user) : string
Parameters
- $user : WP_User
-
Token owner.
Return values
string — Reset-state signature.get_posted_password_reset_bridge_credentials()
Recover validated form credentials after password validation leaves the POST in place.
private
static get_posted_password_reset_bridge_credentials() : array{key: string, login: string}|false
Return values
array{key: string, login: string}|false — Form credentials on success, false otherwise.my_account()
My account page.
private
static my_account(array<string|int, mixed> $atts) : mixed
Parameters
- $atts : array<string|int, mixed>
-
Shortcode attributes.
Return values
mixed —my_account_add_notices()
Add notices to the my account page.
private
static my_account_add_notices() : mixed
Historically a filter has existed to render a message above the my account page content while the user is
logged out. See woocommerce_my_account_message.
Return values
mixed —sign_password_reset_claims()
Sign password-reset bridge claims with the site's nonce salt.
private
static sign_password_reset_claims(array<int, int|string> $claims) : string
Parameters
- $claims : array<int, int|string>
-
Claims to sign.