Ticket #54987: 54987.diff

src/wp-includes/user.php

@@ -1971 +1971 @@
                 return new WP_Error( 'invalid_username', __( 'Sorry, that username is not allowed.' ) );
         }
 
-        /*
-         * If a nicename is provided, remove unsafe user characters before using it.
-         * Otherwise build a nicename from the user_login.
-         */
-        if ( ! empty( $userdata['user_nicename'] ) ) {
-                $user_nicename = sanitize_user( $userdata['user_nicename'], true );
-                if ( mb_strlen( $user_nicename ) > 50 ) {
-                        return new WP_Error( 'user_nicename_too_long', __( 'Nicename may not be longer than 50 characters.' ) );
-                }
+        if (! empty( $userdata['user_nicename'] )) {
+                // If a nicename is provided, remove unsafe user characters before using it.
+                $sanitized_user_nicename = sanitize_user( $userdata['user_nicename'], true );
         } else {
-                $user_nicename = mb_substr( $user_login, 0, 50 );
+                // Otherwise build a nicename from the user_login.
+                $sanitized_user_nicename = mb_substr( $user_login, 0, 50 );
         }
 
-        $user_nicename = sanitize_title( $user_nicename );
-
         /**
          * Filters a user's nicename before the user is created or updated.
          *
@@ -1993 +1986 @@
          *
          * @param string $user_nicename The user's nicename.
          */
-        $user_nicename = apply_filters( 'pre_user_nicename', $user_nicename );
+        $user_nicename = apply_filters( 'pre_user_nicename', $sanitized_user_nicename );
+
+        if ( mb_strlen( $user_nicename ) > 50 ) {
+                return new WP_Error( 'user_nicename_too_long', __( 'Nicename may not be longer than 50 characters.' ) );
+        }
+
+        $user_nicename = sanitize_title( $user_nicename );
 
         $user_nicename_check = $wpdb->get_var( $wpdb->prepare( "SELECT ID FROM $wpdb->users WHERE user_nicename = %s AND user_login != %s LIMIT 1", $user_nicename, $user_login ) );
 
@@ -2043 +2042 @@
          */
         $user_url = apply_filters( 'pre_user_url', $raw_user_url );
 
+        if ( mb_strlen( $user_url ) > 100 ) {
+                return new WP_Error( 'user_url_too_long', __( 'URL may not be longer than 100 characters.' ) );
+        }
+
         $user_registered = empty( $userdata['user_registered'] ) ? gmdate( 'Y-m-d H:i:s' ) : $userdata['user_registered'];
 
         $user_activation_key = empty( $userdata['user_activation_key'] ) ? '' : $userdata['user_activation_key'];