Commit cca0faa934 for wordpress.org

commit cca0faa93420caf10830366721540033097f0bfd
Author: peterwilsoncc <peterwilsoncc@git.wordpress.org>
Date:   Wed Oct 14 21:54:49 2026 +0000

    Login and Registration: Support `/.well-known/change-password`.

    Introduce support for the [https://w3c.github.io/webappsec-change-password-url/ Well-Known URL for Changing Passwords], a standardized URL for tools such as password managers to make change of password forms discoverable.

    Per the specification this is only available to WordPress sites installed in the root directory of a domain. The URL `example.com/.well-known/change-password` will redirect a user to their profile page.

    Introduces the filter `wp_change_password_url` to allow sites using a non-standard location for managing user passwords. If this is hosted on an another host, the host will need to be added to the allow list via the `allowed_redirect_hosts` filter in order to pass the `wp_safe_redirect()` validation process.

    Developed in https://github.com/WordPress/wordpress-develop/pull/12621

    Props audrasjb, ayeshrajans, hasnainashfaq, jns141191, johnbillion, masteradhoc, pfefferle, romainmrhenry, sajib1223, sergeybiryukov, swissspidy.
    Fixes #51173.

    Built from https://develop.svn.wordpress.org/trunk@64348


    git-svn-id: http://core.svn.wordpress.org/trunk@63498 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-includes/canonical.php b/wp-includes/canonical.php
index 764668cccd..2fb3d74bb9 100644
--- a/wp-includes/canonical.php
+++ b/wp-includes/canonical.php
@@ -1078,4 +1078,37 @@ function wp_redirect_admin_locations() {
 		wp_redirect( wp_login_url() );
 		exit;
 	}
+
+	/**
+	 * Filters the well-known change password URL (/.well-known/change-password).
+	 *
+	 * By default visiting the well-known change password URL will redirect to
+	 * the user's profile page when requested by a browser or password manager.
+	 *
+	 * Sites with a custom URL structure for modifying the passwords can modify
+	 * the destination with this filter.
+	 *
+	 * The resulting URL is redirected using {@see wp_safe_redirect}, if the
+	 * filtered URL is on an external host, that host will need to be included
+	 * as an allowed host via the {@see 'allowed_redirect_hosts'} filter.
+	 *
+	 * @since 7.2.0
+	 *
+	 * @param string $change_password_url The URL to redirect to. Default is the user profile page.
+	 */
+	$change_password_url = apply_filters( 'wp_change_password_url', admin_url( 'profile.php' ) );
+
+	/*
+	 * The well-known change-password URL is always at the root of the origin
+	 * per the spec (https://w3c.github.io/webappsec-change-password-url/), so
+	 * only the root-relative path is matched here, regardless of whether
+	 * WordPress is installed in a subdirectory.
+	 */
+	if (
+		'/.well-known/change-password' === untrailingslashit( $_SERVER['REQUEST_URI'] )
+		&& $change_password_url
+		&& wp_safe_redirect( $change_password_url )
+	) {
+		exit;
+	}
 }
diff --git a/wp-includes/version.php b/wp-includes/version.php
index fd3b30a32b..4703ca287c 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-alpha-64347';
+$wp_version = '7.2-alpha-64348';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.