diff --git a/src/wp-admin/includes/user.php b/src/wp-admin/includes/user.php
index 6ec23fb576..3ec716e08e 100644
--- a/src/wp-admin/includes/user.php
+++ b/src/wp-admin/includes/user.php
@@ -142,6 +142,12 @@ function edit_user( $user_id = 0 ) {
if ( !$update && username_exists( $user->user_login ) )
$errors->add( 'user_login', __( 'ERROR: This username is already registered. Please choose another one.' ));
+ /** This filter is documented in wp-includes/user-functions.php */
+ $usernames = apply_filters( 'illegal_user_logins', array() );
+ if ( in_array( $user->user_login, $usernames ) ) {
+ $errors->add( 'illegal_user_login', __( 'ERROR: Sorry, that username is not allowed.' ) );
+ }
+
/* checking email address */
if ( empty( $user->user_email ) ) {
$errors->add( 'empty_email', __( 'ERROR: Please enter an email address.' ), array( 'form-field' => 'email' ) );
diff --git a/src/wp-includes/ms-functions.php b/src/wp-includes/ms-functions.php
index 49407ecb64..f4c11f0c88 100644
--- a/src/wp-includes/ms-functions.php
+++ b/src/wp-includes/ms-functions.php
@@ -427,8 +427,14 @@ function wpmu_validate_user_signup($user_name, $user_email) {
$illegal_names = array( 'www', 'web', 'root', 'admin', 'main', 'invite', 'administrator' );
add_site_option( 'illegal_names', $illegal_names );
}
- if ( in_array( $user_name, $illegal_names ) )
- $errors->add('user_name', __( 'That username is not allowed.' ) );
+ if ( in_array( $user_name, $illegal_names ) ) {
+ $errors->add( 'user_name', __( 'Sorry, that username is not allowed.' ) );
+ }
+
+ /** This filter is documented in wp-includes/user-functions.php */
+ if ( in_array( $user_name, apply_filters( 'illegal_user_logins', array() ) ) ) {
+ $errors->add( 'user_name', __( 'Sorry, that username is not allowed.' ) );
+ }
if ( is_email_address_unsafe( $user_email ) )
$errors->add('user_email', __('You cannot use that email address to signup. We are having problems with them blocking some of our email. Please use another email provider.'));
diff --git a/src/wp-includes/user-functions.php b/src/wp-includes/user-functions.php
index 18ed9af8ef..48c7791939 100644
--- a/src/wp-includes/user-functions.php
+++ b/src/wp-includes/user-functions.php
@@ -1315,6 +1315,17 @@ function wp_insert_user( $userdata ) {
return new WP_Error( 'existing_user_login', __( 'Sorry, that username already exists!' ) );
}
+ /**
+ * Filter the list of blacklisted usernames.
+ *
+ * @since 4.4.0
+ *
+ * @param array $usernames Array of blacklisted usernames.
+ */
+ if ( in_array( $user_login, apply_filters( 'illegal_user_logins', array() ) ) ) {
+ return new WP_Error( 'illegal_user_login', __( 'Sorry, that username is not allowed.' ) );
+ }
+
/*
* If a nicename is provided, remove unsafe user characters before using it.
* Otherwise build a nicename from the user_login.
diff --git a/tests/phpunit/tests/user.php b/tests/phpunit/tests/user.php
index b111ab3d2c..f86c0e52b7 100644
--- a/tests/phpunit/tests/user.php
+++ b/tests/phpunit/tests/user.php
@@ -602,6 +602,59 @@ class Tests_User extends WP_UnitTestCase {
}
}
+ /**
+ * @ticket 27317
+ */
+ function test_illegal_user_logins_single() {
+ $user_data = array(
+ 'user_login' => 'testuser',
+ 'user_email' => 'testuser@example.com',
+ 'user_pass' => wp_generate_password(),
+ );
+
+ add_filter( 'illegal_user_logins', array( $this, '_illegal_user_logins' ) );
+
+ $response = wp_insert_user( $user_data );
+ $this->assertInstanceOf( 'WP_Error', $response );
+ $this->assertEquals( 'illegal_user_login', $response->get_error_code() );
+
+ remove_filter( 'illegal_user_logins', array( $this, '_illegal_user_logins' ) );
+
+ $user_id = wp_insert_user( $user_data );
+ $user = get_user_by( 'id', $user_id );
+ $this->assertInstanceOf( 'WP_User', $user );
+ }
+
+ /**
+ * @ticket 27317
+ */
+ function test_illegal_user_logins_multisite() {
+ if ( ! is_multisite() ) {
+ return;
+ }
+
+ $user_data = array(
+ 'user_login' => 'testuser',
+ 'user_email' => 'testuser@example.com',
+ );
+
+ add_filter( 'illegal_user_logins', array( $this, '_illegal_user_logins' ) );
+
+ $response = wpmu_validate_user_signup( $user_data['user_login'], $user_data['user_email'] );
+ $this->assertInstanceOf( 'WP_Error', $response['errors'] );
+ $this->assertEquals( 'user_name', $response['errors']->get_error_code() );
+
+ remove_filter( 'illegal_user_logins', array( $this, '_illegal_user_logins' ) );
+
+ $response = wpmu_validate_user_signup( $user_data['user_login'], $user_data['user_email'] );
+ $this->assertInstanceOf( 'WP_Error', $response['errors'] );
+ $this->assertEquals( 0, count( $response['errors']->get_error_codes() ) );
+ }
+
+ function _illegal_user_logins() {
+ return array( 'testuser' );
+ }
+
/**
* @ticket 24618
*/