Ticket #28004: 28004.diff

src/wp-includes/user-functions.php

@@ -1275 +1275 @@
         } elseif ( $userdata instanceof WP_User ) {
                 $userdata = $userdata->to_array();
         }
+
         // Are we updating or creating?
         if ( ! empty( $userdata['ID'] ) ) {
                 $ID = (int) $userdata['ID'];
                 $update = true;
-                $old_user_data = WP_User::get_data_by( 'id', $ID );
+                $old_user_data = get_userdata( $ID );
+
+                if ( ! $old_user_data ) {
+                        return new WP_Error( 'invalid_user_id', __( 'Invalid user ID.' ) );
+                }
+
                 // hashed in wp_update_user(), plaintext if called directly
                 $user_pass = $userdata['user_pass'];
         } else {

tests/phpunit/tests/user.php

@@ -757 +757 @@
                 $this->assertSame( $expected, $user->user_nicename );
         }
 
+        /**
+         * @ticket 28004
+         */
+        public function test_wp_insert_user_with_invalid_user_id() {
+                $user_login = str_repeat( 'a', 55 );
+                $u = wp_insert_user( array(
+                        'ID' => 123,
+                        'user_login' => $user_login,
+                        'user_email' => $user_login . '@example.com',
+                        'user_pass' => 'password',
+                ) );
+
+                $this->assertWPError( $u );
+        }
+
         function test_changing_email_invalidates_password_reset_key() {
                 global $wpdb;
 
@@ -963 +978 @@
                 $user = get_userdata( $testuserid );
                 $pwd_before = $user->user_pass;
                 wp_update_user( $user );
-                
+
                 // Reload the data
                 $pwd_after = get_userdata( $testuserid )->user_pass;
                 $this->assertEquals( $pwd_before, $pwd_after );