Changeset 22461

Timestamp:

11/08/2012 01:06:17 AM (12 years ago)

Author:

nacin

Message:

Fix the matching in is_email_address_unsafe(), which was too aggressive.

We should only check to see if the user's email address has the same
domain as or is a subdomain of any banned email domain.

Add a filter.

props mdawaffe.
fixes #21570.

File:

• trunk/wp-includes/ms-functions.php (modified) (1 diff)

trunk/wp-includes/ms-functions.php

@@ -376 +376 @@
 function is_email_address_unsafe( $user_email ) {
     $banned_names = get_site_option( 'banned_email_domains' );
-    if ($banned_names && !is_array( $banned_names ))
-        $banned_names = explode( "\n", $banned_names);
-
-    if ( is_array( $banned_names ) && empty( $banned_names ) == false ) {
-        $email_domain = strtolower( substr( $user_email, 1 + strpos( $user_email, '@' ) ) );
-        foreach ( (array) $banned_names as $banned_domain ) {
-            if ( $banned_domain == '' )
+    if ( $banned_names && ! is_array( $banned_names ) )
+        $banned_names = explode( "\n", $banned_names );
+
+    $is_email_address_unsafe = false;
+
+    if ( $banned_names && is_array( $banned_names ) ) {
+        list( $email_local_part, $email_domain ) = explode( '@', $user_email );
+
+        foreach ( $banned_names as $banned_domain ) {
+            if ( ! $banned_domain )
                 continue;
-            if (
-                strstr( $email_domain, $banned_domain ) ||
-                (
-                    strstr( $banned_domain, '/' ) &&
-                    preg_match( $banned_domain, $email_domain )
-                )
-            )
-            return true;
+
+            if ( $email_domain == $banned_domain ) {
+                $is_email_address_unsafe = true;
+                break;
+            }
+
+            $dotted_domain = ".$banned_domain";
+            if ( $dotted_domain === substr( $user_email, -strlen( $dotted_domain ) ) ) {
+                $is_email_address_unsafe = true;
+                break;
+            }
         }
     }
-    return false;
+
+    return apply_filters( 'is_email_address_unsafe', $is_email_address_unsafe, $user_email );
 }