return $error;
} /*
* Strips out anything non-alphanumeric. This is so passwords can be used with
* or without spaces to indicate the groupings for readability.
*
* Generated application passwords are exclusively alphanumeric.
*/
$password =
preg_replace( '/[^a-z\d]/i', '',
$password );
$hashed_passwords = WP_Application_Passwords::
get_user_application_passwords( $user->ID
);
foreach ( $hashed_passwords as $key =>
$item ) { if ( !
wp_check_password( $password,
$item['password'
],
$user->ID
) ) { continue;
} $error =
new WP_Error();
/**
* Fires when an application password has been successfully checked as valid.
*
* This allows for plugins to add additional constraints to prevent an application password from being used.
*
* @since 5.6.0
*
* @param WP_Error $error The error object.
* @param WP_User $user The user authenticating.
* @param array $item The details about the application password.
* @param string $password The raw supplied password.
*/