Ticket #21537: 21537.diff

src/wp-includes/default-filters.php

@@ -46 +46 @@
 foreach ( array( 'pre_comment_author_email', 'pre_user_email' ) as $filter ) {
         add_filter( $filter, 'trim'           );
         add_filter( $filter, 'sanitize_email' );
-        add_filter( $filter, 'wp_filter_kses' );
+        add_filter( $filter, 'wp_kses_email' );
 }
 
 // Email admin display

src/wp-includes/kses.php

@@ -1326 +1326 @@
 }
 
 /**
+ * Sanitize email with allowed HTML Kses rules.
+ *
+ * Reverts entities that should not be encoded in email addresses.
+ *
+ * @since 4.2.0
+ *
+ * @param string $data Content to filter, expected to not be escaped
+ * @return string Filtered content
+ */
+function wp_kses_email( $data ) {
+        return str_replace( '&', '&', wp_filter_kses( $data , current_filter() ) );
+}
+
+/**
  * Sanitize content with allowed HTML Kses rules.
  *
  * @since 2.9.0

tests/phpunit/tests/user.php

@@ -617 +617 @@
                 $metas = array_keys( get_user_meta( 1 ) );
                 $this->assertNotContains( 'key', $metas );
         }
+        
+        /**
+         * @ticket 21537
+         */
+        function test_user_should_not_sanitize_ampersands() {
+                $random_string = rand_str();
+                $raw_user_email = 'taco&chalupa@burrito.com';
+
+                // Test filter
+                $user_email = apply_filters( 'pre_user_email', $raw_user_email );
+                $this->assertSame( $raw_user_email, $user_email );
+                
+                // Test insert user
+                $id1 = wp_insert_user( array(
+                        'user_login' => $random_string,
+                        'user_pass' => 'password',
+                        'user_email' => $raw_user_email,
+                ) );
+                $this->assertEquals( $id1, email_exists( $raw_user_email ) );
+                $this->assertEquals( $id1, get_user_by( 'email', $raw_user_email )->ID );
+                
+                // Test create comment
+                $post_id = $this->factory->post->create();
+                $comment_id = wp_insert_comment(array(
+                        'comment_post_ID' => $post_id,
+                        'comment_author' => $random_string,
+                        'comment_content' => $random_string,
+                        'comment_author_email' => $raw_user_email,
+                ));
+                $comment = get_comment( $comment_id );
+                $this->assertSame( $raw_user_email, $comment->comment_author_email );
+        }
 
         /**
          * @ticket 29696