Ticket #57394: 57394.diff

src/wp-includes/user.php

@@ -2124 +2124 @@
                 return new WP_Error( 'user_login_too_long', __( 'Username may not be longer than 60 characters.' ) );
         }
 
-        if ( ! $update && username_exists( $user_login ) ) {
-                return new WP_Error( 'existing_user_login', __( 'Sorry, that username already exists!' ) );
+        // Check additional restrictions for new users.
+        if ( ! $update ) {
+
+                // Username must be unique.
+                if ( username_exists( $user_login ) ) {
+                        return new WP_Error( 'existing_user_login', __( 'Sorry, that username already exists!' ) );
+                }
+
+                // Username must not match an existing user email.
+                if ( email_exists( $user_login ) ) {
+                        return new WP_Error( 'existing_user_email_as_login', __( 'Sorry, that username is not available.' ) );
+                }
         }
 
         /**
@@ -3354 +3364 @@
                 $sanitized_user_login = '';
         } elseif ( username_exists( $sanitized_user_login ) ) {
                 $errors->add( 'username_exists', __( '<strong>Error:</strong> This username is already registered. Please choose another one.' ) );
+        } elseif ( email_exists( $sanitized_user_login ) ) {
+                $errors->add( 'username_exists_as_email', __( '<strong>Error:</strong> This username is not available. Please choose another one.' ) );
         } else {
                 /** This filter is documented in wp-includes/user.php */
                 $illegal_user_logins = (array) apply_filters( 'illegal_user_logins', array() );

tests/phpunit/tests/user.php

@@ -915 +915 @@
                 $this->assertSame( 'user_nicename_too_long', $u->get_error_code() );
         }
 
+
+        /**
+         * @ticket 57394
+         */
+        public function test_wp_insert_user_should_reject_user_login_that_matches_existing_user_email() {
+                // When creating a user, the user_login should not match an existing user's email.
+                $existing_email = get_option( 'admin_email' );
+                $user_id        = wp_insert_user(
+                        array(
+                                'user_login'    => $existing_email,
+                                'user_email'    => 'whatever@example.com',
+                                'user_pass'     => 'whatever',
+                                'user_nicename' => 'whatever',
+                        )
+                );
+                $this->assertWPError( $user_id );
+                $this->assertSame( 'existing_user_email_as_login', $user_id->get_error_code() );
+
+                // When updating a user, the user_login can match an existing user's email.
+                $new_email = 'new.email@example.com';
+
+                $user_id = wp_insert_user(
+                        array(
+                                'user_login'    => $new_email,
+                                'user_email'    => $new_email,
+                                'user_pass'     => 'whatever',
+                                'user_nicename' => 'whatever',
+                        )
+                );
+                $this->assertNotWPError( $user_id );
+
+                $user_id = wp_update_user(
+                        array(
+                                'ID'            => $user_id,
+                                'user_login'    => $new_email,
+                                'user_email'    => $new_email,
+                                'user_nicename' => 'new-nicename',
+                        )
+                );
+                // No error should be returned.
+                $this->assertNotWPError( $user_id );
+                // The user_nicename should have been updated.
+                $this->assertSame( 'new-nicename', get_userdata( $user_id )->user_nicename );
+        }
+
         /**
          * @ticket 33793
          */