mirror_php/wordpress
1
0
Fork 0
mirror of git://develop.git.wordpress.org/ synced 2025-02-24 16:43:06 +01:00
Code Issues Actions 11 Packages Projects Releases Wiki Activity

Always sanitize user_nicename in wp_insert_user().

Browse Source 
Previously, a 'user_nicename' parameter passed into the function was
unsanitized. This could result in a mismatch between the sanitized nicename
generated automatically at user creation, resulting in broken author archive
permalinks.

Props joemcgill.

Fixes #29696.

git-svn-id: https://develop.svn.wordpress.org/trunk@29819 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Boone Gorges 2014-10-02 18:53:24 +00:00
parent dcef5d4583
commit 6ffb0fcafb
2 changed files with 23 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/wp-includes/user.php
View File

@ -1676,12 +1676,17 @@ function wp_insert_user( $userdata ) {
if ( ! $update && username_exists( $user_login ) ) {
return new WP_Error( 'existing_user_login', __( 'Sorry, that username already exists!' ) );
}
if ( empty( $userdata['user_nicename'] ) ) {
$user_nicename = sanitize_title( $user_login );
// If a nicename is provided, remove unsafe user characters before
// using it. Otherwise build a nicename from the user_login.
if ( ! empty( $userdata['user_nicename'] ) ) {
$user_nicename = sanitize_user( $userdata['user_nicename'], true );
} else {
$user_nicename = $userdata['user_nicename'];
$user_nicename = $user_login;
}
$user_nicename = sanitize_title( $user_nicename );
// Store values to save in user meta.
$meta = array();

15
tests/phpunit/tests/user.php
View File

@ -654,4 +654,19 @@ class Tests_User extends WP_UnitTestCase {
$metas = array_keys( get_user_meta( 1 ) );
$this->assertNotContains( 'key', $metas );
}
/**
* @ticket 29696
*/
public function test_wp_insert_user_should_sanitize_user_nicename_parameter() {
$user = $this->factory->user->create_and_get();
$userdata = $user->to_array();
$userdata['user_nicename'] = str_replace( '-', '.', $user->user_nicename );
wp_insert_user( $userdata );
$updated_user = new WP_User( $user->ID );
$this->assertSame( $user->user_nicename, $updated_user->user_nicename );
}
}