Ticket #42766: 42766.4.diff

src/js/_enqueues/admin/user-profile.js

@@ -215 +215 @@
                 var pass1 = $('#pass1').val(), strength;
 
                 $('#pass-strength-result').removeClass('short bad good strong empty');
-                if ( ! pass1 ) {
+                if ( ! pass1 || '' ===  pass1.trim() ) {
                         $( '#pass-strength-result' ).addClass( 'empty' ).html( ' ' );
                         return;
                 }

src/wp-admin/includes/user.php

@@ -47 +47 @@
         $pass1 = '';
         $pass2 = '';
         if ( isset( $_POST['pass1'] ) ) {
-                $pass1 = $_POST['pass1'];
+                $pass1 = trim( $_POST['pass1'] );
         }
         if ( isset( $_POST['pass2'] ) ) {
-                $pass2 = $_POST['pass2'];
+                $pass2 = trim( $_POST['pass2'] );
         }
 
         if ( isset( $_POST['role'] ) && current_user_can( 'promote_users' ) && ( ! $user_id || current_user_can( 'promote_user', $user_id ) ) ) {

tests/phpunit/tests/user.php

@@ -1451 +1451 @@
          * Checks that calling edit_user() with no password returns an error when adding, and doesn't when updating.
          *
          * @ticket 35715
+         * @ticket 42766
          */
         function test_edit_user_blank_pw() {
                 $_POST                 = array();
@@ -1491 +1492 @@
                 $this->assertInternalType( 'int', $user_id );
                 $this->assertSame( 'nickname_updated', $user->nickname );
 
+                // Check not to change an old password if a new password contains only spaces. Ticket #42766
+                $user           = get_user_by( 'ID', $user_id );
+                $old_pass       = $user->user_pass;
+                $_POST['pass1'] = $_POST['pass2'] = '  ';
+
+                $user_id = edit_user( $user_id );
+                $user    = get_user_by( 'ID', $user_id );
+
+                $this->assertInternalType( 'int', $user_id );
+                $this->assertEquals( $old_pass, $user->user_pass );
+
                 // Check updating user with missing second password.
                 $_POST['nickname'] = 'nickname_updated2';
                 $_POST['pass1']    = 'blank_pass2';