Ticket #38744: 38744-fixes.3.diff.patch

src/wp-admin/includes/user.php

@@ -41 +41 @@
         }
 
         if ( ! $update && isset( $_POST['user_login'] ) ) {
-                $user->user_login = sanitize_user( $_POST['user_login'], true );
+                $user->user_login = sanitize_user( wp_unslash( $_POST['user_login'] ), true );
         }
 
         $pass1 = $pass2 = '';

src/wp-includes/user.php

@@ -35 +35 @@
                 $credentials = array(); // Back-compat for plugins passing an empty string.
 
                 if ( ! empty( $_POST['log'] ) ) {
-                        $credentials['user_login'] = $_POST['log'];
+                        $credentials['user_login'] = wp_unslash( $_POST['log'] );
                 }
                 if ( ! empty( $_POST['pwd'] ) ) {
                         $credentials['user_password'] = $_POST['pwd'];

src/wp-login.php

@@ -805 +805 @@
 
                 if ( $http_post ) {
                         if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
-                                $user_login = $_POST['user_login'];
+                                $user_login = wp_unslash( $_POST['user_login'] );
                         }
 
                         if ( isset( $_POST['user_email'] ) && is_string( $_POST['user_email'] ) ) {
@@ -913 +913 @@
 
                 // If the user wants SSL but the session is not SSL, force a secure cookie.
                 if ( ! empty( $_POST['log'] ) && ! force_ssl_admin() ) {
-                        $user_name = sanitize_user( $_POST['log'] );
+                        $user_name = sanitize_user( wp_unslash( $_POST['log'] ));
                         $user      = get_user_by( 'login', $user_name );
 
                         if ( ! $user && strpos( $user_name, '@' ) ) {

tests/phpunit/tests/user.php

@@ -34 +34 @@
                         )
                 );
 
+                self::$user_ids[]  = $factory->user->create(
+                        array(
+                                'user_login'    => "testemailaddress'@test.com",
+                                'user_nicename' => 'user_email_with_apostrophe',
+                                'user_pass'     => 'password',
+                                'first_name'    => 'John',
+                                'last_name'     => 'Doe',
+                                'display_name'  => 'John Doe',
+                                'user_email'    => "testemailaddress'@test.com",
+                                'user_url'      => 'http://tacos.com',
+                                'role'          => 'contributor',
+                                'nickname'      => 'Johnny',
+                                'description'   => 'I am a WordPress user that cares about privacy.',
+                        )
+                );
+
                 self::$user_ids[] = self::$author_id = $factory->user->create(
                         array(
                                 'user_login' => 'author_login',
@@ -60 +76 @@
                 $this->author = clone self::$_author;
         }
 
+        public function test_that_you_can_login_with_an_email_that_has_apostrophe(){
+        
+                //create the user with an email that has an apostrophe (see test setup)
+                
+                //login as the user
+                $credentials = [
+                        'user_login' => "testemailaddress'@test.com",
+                        'user_password' => 'password'
+                ];
+                
+                //attempt to login
+                $user = wp_signon($credentials);
+        
+                //assert that login was successfull
+                //if the login fails, an instance of WP_Error is returned rather than User object
+                $this->assertNotWPError($user);
+        }
+
         function test_get_users_of_blog() {
                 // add one of each user role
                 $nusers = array(