Users: Add extra checking to wp_new_user_notification().

Prevent a notification from being sent when an unrecognised value is passed in the `$notify` parameter.

Props cthreelabs, 360zen.
Fixes #44293.



git-svn-id: https://develop.svn.wordpress.org/trunk@44611 602fd350-edb4-49c9-b593-d223f7449a82

src/wp-includes/pluggable.php

@@ -1894,6 +1894,11 @@ if ( ! function_exists( 'wp_new_user_notification' ) ) :
 			_deprecated_argument( __FUNCTION__, '4.3.1' );
 		}
 
+		// Accepts only 'user', 'admin' , 'both' or default '' as $notify
+		if ( ! in_array( $notify, array( 'user', 'admin', 'both', '' ), true ) ) {
+			return;
+		}
+
 		global $wpdb, $wp_hasher;
 		$user = get_userdata( $user_id );
 

tests/phpunit/tests/user.php

@@ -1169,6 +1169,11 @@ class Tests_User extends WP_UnitTestCase {
 				true,
 				true,
 			),
+			array(
+				'THIS IS NOT A SUPPORTED NOTIFICATION TYPE',
+				false,
+				false,
+			),
 		);
 	}