Changeset 34118

Timestamp:

09/14/2015 01:02:03 PM (9 years ago)

Author:

ocean90

Message:

Passwords: Deprecate second parameter of wp_new_user_notification().

The second parameter $plaintext_pass was removed in [33023] and restored as $notify in [33620] with a different behavior. If you have a plugin overriding wp_new_user_notification() which hasn't been updated you would get a notification with your username and the password "both".
To prevent this the second parameter is now deprecated and reintroduced as the third parameter.

Adds unit tests.

Merge of [34116] to the 4.3 branch.

Props kraftbj, adamsilverstein, welcher, ocean90.
See #33654.

Location:

branches/4.3

Files:

• src/wp-admin/includes/user.php (modified) (1 diff)
• src/wp-admin/network/site-new.php (modified) (1 diff)
• src/wp-admin/network/site-users.php (modified) (1 diff)
• src/wp-admin/network/user-new.php (modified) (1 diff)
• src/wp-includes/pluggable.php (modified) (1 diff)
• src/wp-includes/user.php (modified) (1 diff)
• tests/phpunit/tests/user.php (modified) (1 diff)

branches/4.3/src/wp-admin/includes/user.php

@@ -177 +177 @@
     } else {
         $user_id = wp_insert_user( $user );
-        wp_new_user_notification( $user_id, 'both' );
+        wp_new_user_notification( $user_id, null, 'both' );
     }
     return $user_id;

branches/4.3/src/wp-admin/network/site-new.php

@@ -80 +80 @@
             wp_die( __( 'There was an error creating the user.' ) );
         else
-            wp_new_user_notification( $user_id, 'both' );
+            wp_new_user_notification( $user_id, null, 'both' );
     }
 

branches/4.3/src/wp-admin/network/site-users.php

@@ -78 +78 @@
                     $update = 'err_new_dup';
                 } else {
-                    wp_new_user_notification( $user_id, 'both' );
+                    wp_new_user_notification( $user_id, null, 'both' );
                     add_user_to_blog( $id, $user_id, $_POST['new_role'] );
                     $update = 'newuser';

branches/4.3/src/wp-admin/network/user-new.php

@@ -52 +52 @@
             $add_user_errors = new WP_Error( 'add_user_fail', __( 'Cannot add user.' ) );
         } else {
-            wp_new_user_notification( $user_id, 'both' );
+            wp_new_user_notification( $user_id, null, 'both' );
             wp_redirect( add_query_arg( array('update' => 'added'), 'user-new.php' ) );
             exit;

branches/4.3/src/wp-includes/pluggable.php

@@ -1690 +1690 @@
  * @since 2.0.0
  * @since 4.3.0 The `$plaintext_pass` parameter was changed to `$notify`.
+ * @since 4.3.1 The `$plaintext_pass` parameter was deprecated. `$notify` added as a third parameter.
  *
  * @global wpdb         $wpdb      WordPress database object for queries.
  * @global PasswordHash $wp_hasher Portable PHP password hashing framework instance.
  *
- * @param int    $user_id User ID.
- * @param string $notify  Whether admin and user should be notified ('both') or
- *                        only the admin ('admin' or empty).
- */
-function wp_new_user_notification( $user_id, $notify = '' ) {
+ * @param int    $user_id    User ID.
+ * @param null   $deprecated Not used (argument deprecated).
+ * @param string $notify     Optional. Type of notification that should happen. Accepts 'admin' or an empty
+ *                           string (admin only), or 'both' (admin and user). The empty string value was kept
+ *                           for backward-compatibility purposes with the renamed parameter. Default empty.
+ */
+function wp_new_user_notification( $user_id, $deprecated = null, $notify = '' ) {
+    if ( $deprecated !== null ) {
+        _deprecated_argument( __FUNCTION__, '4.3.1' );
+    }
+
     global $wpdb, $wp_hasher;
     $user = get_userdata( $user_id );

branches/4.3/src/wp-includes/user.php

@@ -2620 +2620 @@
     update_user_option( $user_id, 'default_password_nag', true, true ); //Set up the Password change nag.
 
-    wp_new_user_notification( $user_id, 'both' );
+    wp_new_user_notification( $user_id, null, 'both' );
 
     return $user_id;

branches/4.3/tests/phpunit/tests/user.php

@@ -680 +680 @@
     }
 
+    /**
+     * Testing wp_new_user_notification email statuses.
+     *
+     * @dataProvider data_wp_new_user_notifications
+     * @ticket 33654
+     */
+    function test_wp_new_user_notification( $notify, $admin_email_sent_expected, $user_email_sent_expected ) {
+        unset( $GLOBALS['phpmailer']->mock_sent );
+
+        $was_admin_email_sent = false;
+        $was_user_email_sent = false;
+
+        $user = $this->factory->user->create( $this->user_data );
+
+        wp_new_user_notification( $user, null, $notify );
+
+        /*
+         * Check to see if a notification email was sent to the
+         * post author `blackburn@battlefield3.com` and and site admin `admin@example.org`.
+         */
+        if ( ! empty( $GLOBALS['phpmailer']->mock_sent ) ) {
+            $was_admin_email_sent = ( isset( $GLOBALS['phpmailer']->mock_sent[0] ) && WP_TESTS_EMAIL == $GLOBALS['phpmailer']->mock_sent[0]['to'][0][0] );
+            $was_user_email_sent = ( isset( $GLOBALS['phpmailer']->mock_sent[1] ) && 'blackburn@battlefield3.com' == $GLOBALS['phpmailer']->mock_sent[1]['to'][0][0] );
+        }
+
+        $this->assertSame( $admin_email_sent_expected, $was_admin_email_sent, 'Admin email result was not as expected in test_wp_new_user_notification' );
+        $this->assertSame( $user_email_sent_expected , $was_user_email_sent, 'User email result was not as expected in test_wp_new_user_notification' );
+    }
+
+    /**
+     * Data provider for test_wp_new_user_notification().
+     *
+     * Passes the three available options for the $notify parameter and the expected email
+     * emails sent status as a bool.
+     *
+     * @return array {
+     *     @type array {
+     *         @type string $post_args               The arguments that will merged with the $_POST array.
+     *         @type bool $admin_email_sent_expected The expected result of whether an email was sent to the admin.
+     *         @type bool $user_email_sent_expected  The expected result of whether an email was sent to the user.
+     *     }
+     * }
+     */
+    function data_wp_new_user_notifications() {
+        return array(
+            array(
+                '',
+                true,
+                false,
+            ),
+            array(
+                'admin',
+                true,
+                false,
+            ),
+            array(
+                'both',
+                true,
+                true,
+            ),
+        );
+    }
+
+    /**
+     * Set up a user and try sending a notification using the old, deprecated
+     * function signature `wp_new_user_notification( $user, 'plaintext_password' );`.
+     *
+     * @ticket 33654
+     * @expectedDeprecated wp_new_user_notification
+     */
+    function test_wp_new_user_notification_old_signature_throws_deprecated_warning() {
+        $user = $this->factory->user->create(
+            array(
+                'role'       => 'author',
+                'user_login' => 'test_wp_new_user_notification',
+                'user_pass'  => 'password',
+                'user_email' => 'test@test.com',
+            )
+        );
+
+        wp_new_user_notification( $user, 'this_is_deprecated' );
+    }
 }