Ticket #27317: 27317.4.patch

src/wp-admin/includes/user.php

@@ -142 +142 @@
                 $errors->add( 'pass', __( '<strong>ERROR</strong>: Passwords may not contain the character "\\".' ), array( 'form-field' => 'pass1' ) );
 
         /* checking the password has been typed twice the same */
-        if ( $pass1 != $pass2 )
+        if ( $pass1 != $pass2 ) {
                 $errors->add( 'pass', __( '<strong>ERROR</strong>: Please enter the same password in the two password fields.' ), array( 'form-field' => 'pass1' ) );
+        }
 
         if ( !empty( $pass1 ) )
                 $user->user_pass = $pass1;
 
-        if ( !$update && isset( $_POST['user_login'] ) && !validate_username( $_POST['user_login'] ) )
-                $errors->add( 'user_login', __( '<strong>ERROR</strong>: This username is invalid because it uses illegal characters. Please enter a valid username.' ));
+        if ( !$update && isset( $_POST['user_login'] ) && !validate_username( $_POST['user_login'] ) ) {
+                $errors->add( 'user_login', __( '<strong>ERROR</strong>: This username is invalid because it uses illegal characters. Please enter a valid username.' ) );
+        }
 
-        if ( !$update && username_exists( $user->user_login ) )
+        if ( !$update && username_exists( $user->user_login ) ) {
                 $errors->add( 'user_login', __( '<strong>ERROR</strong>: This username is already registered. Please choose another one.' ));
+        }
 
+        /**
+         * Filter which allows usernames to be blacklisted
+         *
+         * @since 4.4.0
+         *
+         * @param array array() Array of blacklisted usernames
+         */
+        if ( in_array( $user->user_login, apply_filters( 'illegal_user_logins', array() ) ) ) {
+                $errors->add( 'illegal_user_login', __( "Sorry, that username is not allowed." ) );
+        }       
+
         /* checking email address */
         if ( empty( $user->user_email ) ) {
                 $errors->add( 'empty_email', __( '<strong>ERROR</strong>: Please enter an email address.' ), array( 'form-field' => 'email' ) );

src/wp-includes/ms-functions.php

@@ -488 +488 @@
         if ( in_array( $user_name, $illegal_names ) )
                 $errors->add('user_name',  __( 'That username is not allowed.' ) );
 
+        if ( in_array( $user_name, apply_filters( 'illegal_user_logins', array() ) ) ) {
+                $errors->add('user_name',  __( 'That username is not allowed.' ) );
+        }
+
         if ( is_email_address_unsafe( $user_email ) )
                 $errors->add('user_email',  __('You cannot use that email address to signup. We are having problems with them blocking some of our email. Please use another email provider.'));
 

src/wp-includes/user-functions.php

@@ -1292 +1292 @@
                 return new WP_Error( 'existing_user_login', __( 'Sorry, that username already exists!' ) );
         }
 
+        /**
+         * Defined in /wp-admin/includes/user.php
+         */
+        if ( in_array( $user_login, apply_filters( 'illegal_user_logins', array() ) ) ) {
+                $return new WP_Error( 'illegal_user_login', __( "Sorry, that username is not allowed." ) );
+        }       
+
         /*
          * If a nicename is provided, remove unsafe user characters before using it.
          * Otherwise build a nicename from the user_login.

tests/phpunit/tests/user.php

@@ -596 +596 @@
                         if ( ! defined( 'WP_IMPORTING' ) ) {
                                 $this->assertWPError( $return );
                         }
+        }
+
+        /**
+         * @ticket 27317
+         */
+        function test_illegal_user_logins_single() {
+
+                $user_data = array(
+                        'user_login'       => 'testuser',
+                        'user_email'       => 'testuser@example.com',
+                        'user_pass'        => wp_generate_password(),
+                        );
+
+                add_filter( 'illegal_user_logins', array( $this, '_illegal_user_logins' ) );
+
+                $response = wp_insert_user( $user_data );
+                $this->assertInstanceOf( 'WP_Error', $response );
+                $this->assertEquals( 'illegal_user_login', $response->get_error_code() );
+
+                remove_filter( 'illegal_user_logins', array( $this, '_illegal_user_logins' ) );
+
+                $user_id = wp_insert_user( $user_data );
+                $user = get_user_by( 'id', $user_id );
+                $this->assertInstanceOf( 'WP_User', $user );
+        }
+
+        /**
+         * @ticket 27317
+         */
+        function test_illegal_user_logins_multisite() {
+
+                if ( ! is_multisite() ) {
+                        return;
                 }
+
+                $user_data = array(
+                        'user_login'       => 'testuser',
+                        'user_email'       => 'testuser@example.com',
+                        );
+
+                add_filter( 'illegal_user_logins', array( $this, '_illegal_user_logins' ) );
+
+                $response = wpmu_validate_user_signup( $user_data['user_login'], $user_data['user_email'] );
+                $this->assertInstanceOf( 'WP_Error', $response['errors'] );
+                $this->assertEquals( 'user_name', $response['errors']->get_error_code() );
+
+                remove_filter( 'illegal_user_logins', array( $this, '_illegal_user_logins' ) );
+
+                $response = wpmu_validate_user_signup( $user_data['user_login'], $user_data['user_email'] );
+                $this->assertInstanceOf( 'WP_Error', $response['errors'] );
+                $this->assertEquals( 0, count( $response['errors']->get_error_codes() ) );
         }
 
+        function _illegal_user_logins() {
+                return array( 'testuser' );     
+        }
+
         /**
          * @ticket 29696
          */