Ticket #27317: 27317.4.diff

src/wp-includes/user.php

@@ -1542 +1542 @@
         if ( !$update && username_exists( $user_login ) )
                 return new WP_Error( 'existing_user_login', __( 'Sorry, that username already exists!' ) );
 
+        if ( in_array( $user_login, apply_filters( 'illegal_user_logins', array() ) ) ) {
+                return new WP_Error( 'illegal-user-login', __( "Sorry, that username is not allowed." ) );
+        }
+
         if ( empty($user_nicename) )
                 $user_nicename = sanitize_title( $user_login );
 
@@ -1982 +1986 @@
                 $sanitized_user_login = '';
         } elseif ( username_exists( $sanitized_user_login ) ) {
                 $errors->add( 'username_exists', __( '<strong>ERROR</strong>: This username is already registered. Please choose another one.' ) );
+        } elseif ( in_array( $sanitized_user_login, apply_filters( 'illegal_user_logins', array() ) ) ) {
+                $errors->add( 'illegal_user_login', __( '<strong>ERROR</strong>: Sorry, that username is not allowed.' ) );
         }
 
         // Check the e-mail address

src/wp-includes/ms-functions.php

@@ -489 +489 @@
         if ( in_array( $user_name, $illegal_names ) == true )
                 $errors->add('user_name',  __( 'That username is not allowed.' ) );
 
+        if ( in_array( $user_name, apply_filters( 'illegal_user_logins', array() ) ) ) {
+                $errors->add('user_name',  __( 'That username is not allowed.' ) );
+        }
+
         if ( is_email_address_unsafe( $user_email ) )
                 $errors->add('user_email',  __('You cannot use that email address to signup. We are having problems with them blocking some of our email. Please use another email provider.'));
 

src/wp-admin/includes/user.php

@@ -176 +176 @@
                 $user_id = wp_update_user( $user );
         } else {
                 $user_id = wp_insert_user( $user );
-                wp_new_user_notification( $user_id, isset( $_POST['send_password'] ) ? wp_unslash( $pass1 ) : '' );
+                if ( ! is_wp_error( $user_id ) ) {
+                        wp_new_user_notification( $user_id, isset( $_POST['send_password'] ) ? wp_unslash( $pass1 ) : '' );
+                }
         }
         return $user_id;
 }

tests/phpunit/tests/user.php

@@ -627 +627 @@
                 // If this test fails, it will error out for calling the to_array() method on a non-object.
                 $this->assertInstanceOf( 'WP_Error', wp_update_user( array( 'ID' => $user_id ) ) );
         }
+
+        /**
+         * @ticket 27317
+         */
+        function test_illegal_user_logins_single() {
+
+                $user_data = array(
+                        'user_login'       => 'testuser',
+                        'user_email'       => 'testuser@example.com',
+                        'user_pass'        => wp_generate_password(),
+                        );
+
+                add_filter( 'illegal_user_logins', array( $this, '_illegal_user_logins' ) );
+
+                $response = wp_insert_user( $user_data );
+                $this->assertInstanceOf( 'WP_Error', $response );
+                $this->assertEquals( 'illegal-user-login', $response->get_error_code() );
+
+                remove_filter( 'illegal_user_logins', array( $this, '_illegal_user_logins' ) );
+
+                $user_id = wp_insert_user( $user_data );
+                $user = get_user_by( 'id', $user_id );
+                $this->assertInstanceOf( 'WP_User', $user );
+        }
+
+        /**
+         * @ticket 27317
+         */
+        function test_illegal_user_logins_multisite() {
+
+                if ( ! is_multisite() ) {
+                        return;
+                }
+
+                $user_data = array(
+                        'user_login'       => 'testuser',
+                        'user_email'       => 'testuser@example.com',
+                        );
+
+                add_filter( 'illegal_user_logins', array( $this, '_illegal_user_logins' ) );
+
+                $response = wpmu_validate_user_signup( $user_data['user_login'], $user_data['user_email'] );
+                $this->assertInstanceOf( 'WP_Error', $response['errors'] );
+                $this->assertEquals( 'user_name', $response['errors']->get_error_code() );
+
+                remove_filter( 'illegal_user_logins', array( $this, '_illegal_user_logins' ) );
+
+                $response = wpmu_validate_user_signup( $user_data['user_login'], $user_data['user_email'] );
+                $this->assertInstanceOf( 'WP_Error', $response['errors'] );
+                $this->assertEquals( 0, count( $response['errors']->get_error_codes() ) );
+        }
+
+        function _illegal_user_logins() {
+                return array( 'testuser' );     
+        }
 }