Ticket #36303: 36303.patch

src/wp-admin/includes/user.php

@@ -37 +37 @@
                 $user->user_login = wp_slash( $userdata->user_login );
         } else {
                 $update = false;
+                $user->user_login = isset( $_POST['user_login'] ) ? sanitize_user( $_POST['user_login'], true ) : '';
         }
 
-        if ( !$update && isset( $_POST['user_login'] ) )
-                $user->user_login = sanitize_user($_POST['user_login'], true);
-
         $pass1 = $pass2 = '';
         if ( isset( $_POST['pass1'] ) )
                 $pass1 = $_POST['pass1'];

tests/phpunit/tests/user.php

@@ -1199 +1199 @@
         function action_check_passwords_blank_pw( $user_login, &$pass1 ) {
                 $pass1 = '';
         }
+
+        /**
+         * Checks that calling edit_user() with no user_login returns a WP error without PHP Notices.
+         *
+         * @ticket 36303
+         */
+        function test_edit_user_blank_user_login() {
+                $_POST = $_GET = $_REQUEST = array();
+                $_POST['role'] = 'subscriber';
+                $_POST['email'] = 'user1@example.com';
+                // Leave unset $_POST['user_login']
+                $_POST['first_name'] = 'first_name1';
+                $_POST['last_name'] = 'last_name1';
+                $_POST['nickname'] = 'nickname1';
+                $_POST['display_name'] = 'display_name1';
+                $_POST['pass1'] = $_POST['pass2'] = 'password';
+
+                // Check new user with unset user_login.
+                $response = edit_user();
+
+                $this->assertInstanceOf( 'WP_Error', $response );
+                $this->assertEquals( array( 'user_login' ), $response->get_error_codes() );
+
+                // Check new user with blank user_login.
+                $_POST['user_login'] = '';
+                $response = edit_user();
+
+                $this->assertInstanceOf( 'WP_Error', $response );
+                $this->assertEquals( array( 'user_login' ), $response->get_error_codes() );
+
+                // Check new user with zero user_login.
+                $_POST['user_login'] = '0';
+                $response = edit_user();
+
+                $this->assertInstanceOf( 'WP_Error', $response );
+                $this->assertEquals( array( 'user_login' ), $response->get_error_codes() );
+
+                // Add user.
+                $_POST['user_login'] = 'user_login1';
+                $user_id = edit_user();
+                $user = get_user_by( 'ID', $user_id );
+
+                $this->assertInternalType( 'int', $user_id );
+                $this->assertInstanceOf( 'WP_User', $user );
+                $this->assertEquals( 'user_login1', $user->user_login );
+                $this->assertEquals( 'nickname1', $user->nickname );
+
+                // Check can update user with unset user_login (ignored).
+                unset( $_POST['user_login'] );
+                $_POST['nickname'] = 'nickname_updated';
+
+                $user_id = edit_user( $user_id );
+                $user = get_user_by( 'ID', $user_id );
+
+                $this->assertInternalType( 'int', $user_id );
+                $this->assertInstanceOf( 'WP_User', $user );
+                $this->assertEquals( 'user_login1', $user->user_login );
+                $this->assertEquals( 'nickname_updated', $user->nickname );
+
+                // Check can update user with blank user_login (ignored).
+                $_POST['user_login'] = '';
+                $_POST['nickname'] = 'nickname_updated2';
+
+                $user_id = edit_user( $user_id );
+                $user = get_user_by( 'ID', $user_id );
+
+                $this->assertInternalType( 'int', $user_id );
+                $this->assertInstanceOf( 'WP_User', $user );
+                $this->assertEquals( 'user_login1', $user->user_login );
+                $this->assertEquals( 'nickname_updated2', $user->nickname );
+
+                // Check can update user with zero user_login (ignored).
+                $_POST['user_login'] = '0';
+                $_POST['nickname'] = 'nickname_updated3';
+
+                $user_id = edit_user( $user_id );
+                $user = get_user_by( 'ID', $user_id );
+
+                $this->assertInternalType( 'int', $user_id );
+                $this->assertInstanceOf( 'WP_User', $user );
+                $this->assertEquals( 'user_login1', $user->user_login );
+                $this->assertEquals( 'nickname_updated3', $user->nickname );
+        }
 }