Custom Front End Registration - How Does the Key work in the Password Set Request?

Question

I've been working from some tutorials on building a front end registration / login system. Specifically this link - http://cubiq.org/front-end-user-registration-and-login-in-wordpress

Everything is working very nicely, however I'm having an issue with the password set. Currently, upon registration, the system uses Wordpress' own registration code to send the Welcome / Create Password email. When clicking the link in the email with login & key in the GET, the following function runs:

function custom_login_init () {
$action = isset($_REQUEST['action']) ? $_REQUEST['action'] : 'login';

if ( isset( $_POST['wp-submit'] ) ) {
    $action = 'post-data';
} else if ( isset( $_GET['reauth'] ) ) {
    $action = 'reauth';
} else if ( isset($_GET['key']) ) {
    $action = 'resetpass-key';
}

// redirect to change password form
if ( $action == 'rp' || $action == 'resetpass' ) {
    wp_redirect( home_url('/member-login/?action=resetpass') );
    exit;
}

// redirect from wrong key when resetting password
if ( $action == 'lostpassword' && isset($_GET['error']) && ( $_GET['error'] == 'expiredkey' || $_GET['error'] == 'invalidkey' ) ) {
    wp_redirect( home_url( '/member-login/?action=forgot&success=wrongkey&error='.$_GET['error'] ) );
    exit;
}

if (
    $action == 'post-data'        ||            // don't mess with POST requests
    $action == 'reauth'           ||            // need to reauthorize
    $action == 'resetpass-key'    ||            // password recovery
    $action == 'logout'                         // user is logging out
) {
    return;
}

wp_redirect( home_url( '/member-login/' ) );
exit;
}
add_action('login_init', 'custom_login_init');

This lets the reset / set password process run on its own for the most part, except for that it eventually redirects the user to a "set password" form, which I believe needs to contain hidden fields with the login and key.

<h1 class="entry-title">Set Your Password</h1>
    <p>Fill out the form below to set your password.</p>
    <form name="resetpasswordform" action="<?php echo site_url('wp-login.php?action=resetpass', 'login_post') ?>" method="post">
        <input type="hidden" id="user_login" name="rp_login" value="<?php echo esc_attr( $_REQUEST['login'] ); ?>" autocomplete="off" />
        <input type="hidden" name="rp_key" value="<?php echo esc_attr( $_REQUEST['key'] ); ?>" />
        <p class="form-password">
            <label for="pass1">New Password</label>
            <input class="text-input" name="pass1" type="password" id="pass1">
        </p>
        <p class="form-password">
            <label for="pass2">Confirm Password</label>
            <input class="text-input" name="pass2" type="password" id="pass2">
        </p>

        <input type="hidden" name="redirect_to" value="/user/?action=resetpass&success=1">
        <p class="submit"><input type="submit" name="wp-submit" id="wp-submit" value="Get New Password" /></p>
    </form>

However, I can't figure out where to get those from for the form fields - I can't see them being set into a cookie, they aren't passed along via GET or POST at that point, they seem to be dropped from the query string once we get to the redirect...

I Googled this exhaustively yesterday, and I can't seem to find up to date information on how this works.

Can anyone shed any light on how this process is meant to work? Do you see something I'm missing either in the function or form?

Answer 1

Because I couldn't find an answer on this, I handled it myself by setting my own cookie in the function and checking that. Here is the revised function:

function custom_login_init () {
$action = isset($_REQUEST['action']) ? $_REQUEST['action'] : 'login';

if ( isset( $_POST['wp-submit'] ) ) {
    $action = 'post-data';
} else if ( isset( $_GET['reauth'] ) ) {
    $action = 'reauth';
} else if ( isset($_GET['key']) ) {
    $date_of_expiry = time() + 60 ;
    setcookie( "key", $_GET['key'], $date_of_expiry );
    setcookie( "login", $_GET['login'], $date_of_expiry );
    $action = 'resetpass-key';
}

// redirect to change password form
if ( $action == 'rp' || $action == 'resetpass' ) {
    wp_redirect( home_url('/member-login/?action=resetpass') );
    exit;
}

// redirect from wrong key when resetting password
if ( $action == 'lostpassword' && isset($_GET['error']) && ( $_GET['error'] == 'expiredkey' || $_GET['error'] == 'invalidkey' ) ) {
    wp_redirect( home_url( '/member-login/?action=forgot&success=wrongkey&error='.$_GET['error'] ) );
    exit;
}

if (
    $action == 'post-data'        ||            // don't mess with POST requests
    $action == 'reauth'           ||            // need to reauthorize
    $action == 'resetpass-key'    ||            // password recovery
    $action == 'logout'                         // user is logging out
) {
    return;
}

wp_redirect( home_url( '/member-login/' ) );
exit;
}
add_action('login_init', 'custom_login_init');

If anyone has insight as to a better way to do this, I'd still appreciate it.