WC_Form_Handler::resend_set_password │ public static │ WC 11.0.0

Resend the change-password link to a logged-in customer who still has a temporary password.

Triggered by the temporary-password notice on the My Account pages. Generates a fresh password-reset key for the current user and dispatches the reset-password email, mirroring the lost-password flow but for the already-authenticated user.

Method of the class: WC_Form_Handler{}

Returns

null. Nothing (null).

Usage

$result = WC_Form_Handler::resend_set_password(): void;

Changelog

WC_Form_Handler::resend_set_password() WC Form Handler::resend set password code ^{WC 11.0.0}

public static function resend_set_password(): void {
	// phpcs:ignore WordPress.Security.NonceVerification.Recommended
	if ( ! isset( $_GET['wc-resend-set-password'] ) || ! is_user_logged_in() ) {
		return;
	}

	// phpcs:ignore WordPress.Security.NonceVerification.Recommended
	$nonce_value = isset( $_GET['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ) : '';

	if ( ! wp_verify_nonce( $nonce_value, 'wc-resend-set-password' ) ) {
		return;
	}

	$user     = wp_get_current_user();
	$redirect = wc_get_page_permalink( 'myaccount' );

	// Rate-limit resends so the button can't be used to spam the customer's inbox.
	$last_sent_at = (int) get_user_meta( $user->ID, self::SET_PASSWORD_RESEND_META, true );
	if ( $last_sent_at > 0 && ( time() - $last_sent_at ) < self::SET_PASSWORD_RESEND_RATE_LIMIT_SECONDS ) {
		wc_add_notice( __( 'Please wait a moment before requesting another link to change your password.', 'woocommerce' ), 'notice' );
		wp_safe_redirect( $redirect );
		exit;
	}

	$key = get_password_reset_key( $user );

	if ( is_wp_error( $key ) ) {
		wc_add_notice( __( 'Sorry, we were unable to resend the link. Please try again.', 'woocommerce' ), 'error' );
	} else {
		// Persist the rate-limit timestamp before dispatching so two near-simultaneous requests can't both pass.
		// This timestamp also suppresses the temporary-password notice during the cooldown — see
		// WC_Shortcode_My_Account::my_account_add_notices() — so the confirmation below isn't contradicted.
		update_user_meta( $user->ID, self::SET_PASSWORD_RESEND_META, (string) time() );
		// Load email classes so the reset-password notification has a listener.
		WC()->mailer();
		// phpcs:ignore WooCommerce.Commenting.CommentHooks -- Re-fires woocommerce_reset_password_notification, documented in WC_Shortcode_My_Account::retrieve_password().
		do_action( 'woocommerce_reset_password_notification', $user->user_login, $key );
		wc_add_notice( __( 'We have emailed you a new link to change your password.', 'woocommerce' ) );
	}

	wp_safe_redirect( $redirect );
	exit;
}