sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Improve validation of user_login and user_nicename length.

Browse Source 
The `user_login` field only allows 60 characters, and `user_nicename` allows
50. However, there are no protections in the interface, and few in the code,
that prevent the creation of users with values in excess of these limits. Prior
to recent changes in `$wpdb`, users were generally created anyway, MySQL
having performed the necessary truncation. More recently, the `INSERT`s and
`UPDATE`s simply fail, with no real feedback on the nature of the failure.

This changeset addresses the issue in a number of ways:
* On the user-new.php and network/user-new.php panels, don't allow input in excess of the maximum field length.
* In `wp_insert_user()`, throw an error if the value provided for `'user_login'` or `'user_nicename'` exceeds the maximum field length.
* In `wp_insert_user()`, when using `'user_login'` to generate a default value for `'user_nicename'`, ensure that the nicename is properly truncated, even when suffixed for uniqueness (username-2, etc).

Props dipesh.kakadiya, utkarshpatel, tommarshall, boonebgorges.
Fixes #33793.

git-svn-id: https://develop.svn.wordpress.org/trunk@34218 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Boone Gorges 2015-09-15 22:13:51 +00:00
parent 2d59d18e3a
commit 0adb6877b2
4 changed files with 108 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/wp-admin/network/user-new.php
View File

@ -89,7 +89,7 @@ if ( isset( $add_user_errors ) && is_wp_error( $add_user_errors ) ) { ?>
<table class="form-table">
<tr class="form-field form-required">
<th scope="row"><label for="username"><?php _e( 'Username' ) ?></label></th>
<td><input type="text" class="regular-text" name="user[username]" id="username" autocapitalize="none" autocorrect="off" /></td>
<td><input type="text" class="regular-text" name="user[username]" id="username" autocapitalize="none" autocorrect="off" maxlength="60" /></td>
</tr>
<tr class="form-field form-required">
<th scope="row"><label for="email"><?php _e( 'Email' ) ?></label></th>

2
src/wp-admin/user-new.php
View File

@ -375,7 +375,7 @@ $new_user_ignore_pass = $creating && isset( $_POST['noconfirmation'] ) ? wp_unsl
<table class="form-table">
<tr class="form-field form-required">
<th scope="row"><label for="user_login"><?php _e('Username'); ?> <span class="description"><?php _e('(required)'); ?></span></label></th>
<td><input name="user_login" type="text" id="user_login" value="<?php echo esc_attr( $new_user_login ); ?>" aria-required="true" autocapitalize="none" autocorrect="off" /></td>
<td><input name="user_login" type="text" id="user_login" value="<?php echo esc_attr( $new_user_login ); ?>" aria-required="true" autocapitalize="none" autocorrect="off" maxlength="60" /></td>
</tr>
<tr class="form-field form-required">
<th scope="row"><label for="email"><?php _e('Email'); ?> <span class="description"><?php _e('(required)'); ?></span></label></th>

19
src/wp-includes/user-functions.php
View File

@ -1245,19 +1245,28 @@ function wp_insert_user( $userdata ) {
//Remove any non-printable chars from the login string to see if we have ended up with an empty username
$user_login = trim( $pre_user_login );
// user_login must be between 0 and 60 characters.
if ( empty( $user_login ) ) {
return new WP_Error('empty_user_login', __('Cannot create a user with an empty login name.') );
} elseif ( mb_strlen( $user_login ) > 60 ) {
return new WP_Error( 'user_login_too_long', __( 'Username may not be longer than 60 characters.' ) );
}
if ( ! $update && username_exists( $user_login ) ) {
return new WP_Error( 'existing_user_login', __( 'Sorry, that username already exists!' ) );
}
// If a nicename is provided, remove unsafe user characters before
// using it. Otherwise build a nicename from the user_login.
/*
* If a nicename is provided, remove unsafe user characters before using it.
* Otherwise build a nicename from the user_login.
*/
if ( ! empty( $userdata['user_nicename'] ) ) {
$user_nicename = sanitize_user( $userdata['user_nicename'], true );
if ( mb_strlen( $user_nicename ) > 50 ) {
return new WP_Error( 'user_nicename_too_long', __( 'Nicename may not be longer than 50 characters.' ) );
}
} else {
$user_nicename = $user_login;
$user_nicename = mb_substr( $user_login, 0, 50 );
}
$user_nicename = sanitize_title( $user_nicename );
@ -1395,7 +1404,9 @@ function wp_insert_user( $userdata ) {
if ( $user_nicename_check ) {
$suffix = 2;
while ($user_nicename_check) {
$alt_user_nicename = $user_nicename . "-$suffix";
// user_nicename allows 50 chars. Subtract one for a hyphen, plus the length of the suffix.
$base_length = 49 - mb_strlen( $suffix );
$alt_user_nicename = mb_substr( $user_nicename, 0, $base_length ) . "-$suffix";
$user_nicename_check = $wpdb->get_var( $wpdb->prepare("SELECT ID FROM $wpdb->users WHERE user_nicename = %s AND user_login != %s LIMIT 1" , $alt_user_nicename, $user_login));
$suffix++;
}

91
tests/phpunit/tests/user.php
View File

@ -574,6 +574,97 @@ class Tests_User extends WP_UnitTestCase {
$this->assertSame( $user->user_nicename, $updated_user->user_nicename );
}
/**
* @ticket 33793
*/
public function test_wp_insert_user_should_reject_user_login_over_60_characters() {
$user_login = str_repeat( 'a', 61 );
$u = wp_insert_user( array(
'user_login' => $user_login,
'user_email' => $user_login . '@example.com',
'user_pass' => 'password',
'user_nicename' => 'something-short',
) );
$this->assertWPError( $u );
$this->assertSame( 'user_login_too_long', $u->get_error_code() );
}
/**
* @ticket 33793
*/
public function test_wp_insert_user_should_reject_user_nicename_over_50_characters() {
$user_nicename = str_repeat( 'a', 51 );
$u = wp_insert_user( array(
'user_login' => 'mynicenamehas50chars',
'user_email' => $user_nicename . '@example.com',
'user_pass' => 'password',
'user_nicename' => $user_nicename,
) );
$this->assertWPError( $u );
$this->assertSame( 'user_nicename_too_long', $u->get_error_code() );
}
/**
* @ticket 33793
*/
public function test_wp_insert_user_should_not_generate_user_nicename_longer_than_50_chars() {
$user_login = str_repeat( 'a', 55 );
$u = wp_insert_user( array(
'user_login' => $user_login,
'user_email' => $user_login . '@example.com',
'user_pass' => 'password',
) );
$this->assertNotEmpty( $u );
$user = new WP_User( $u );
$expected = str_repeat( 'a', 50 );
$this->assertSame( $expected, $user->user_nicename );
}
/**
* @ticket 33793
*/
public function test_wp_insert_user_should_not_truncate_to_a_duplicate_user_nicename() {
$u1 = $this->factory->user->create( array(
'user_nicename' => str_repeat( 'a', 50 ),
) );
$user_login = str_repeat( 'a', 55 );
$u = wp_insert_user( array(
'user_login' => $user_login,
'user_email' => $user_login . '@example.com',
'user_pass' => 'password',
) );
$this->assertNotEmpty( $u );
$user = new WP_User( $u );
$expected = str_repeat( 'a', 48 ) . '-2';
$this->assertSame( $expected, $user->user_nicename );
}
/**
* @ticket 33793
*/
public function test_wp_insert_user_should_not_truncate_to_a_duplicate_user_nicename_when_suffix_has_more_than_one_character() {
$users = $this->factory->user->create_many( 9, array(
'user_nicename' => str_repeat( 'a', 50 ),
) );
$user_login = str_repeat( 'a', 55 );
$u = wp_insert_user( array(
'user_login' => $user_login,
'user_email' => $user_login . '@example.com',
'user_pass' => 'password',
) );
$this->assertNotEmpty( $u );
$user = new WP_User( $u );
$expected = str_repeat( 'a', 47 ) . '-10';
$this->assertSame( $expected, $user->user_nicename );
}
function test_changing_email_invalidates_password_reset_key() {
global $wpdb;