Changeset 34218 for trunk/tests/phpunit/tests/user.php

Timestamp:

09/15/2015 10:13:51 PM (9 years ago)

Author:

boonebgorges

Message:

Improve validation of user_login and user_nicename length.

The user_login field only allows 60 characters, and user_nicename allows

50. However, there are no protections in the interface, and few in the code,

that prevent the creation of users with values in excess of these limits. Prior
to recent changes in $wpdb, users were generally created anyway, MySQL
having performed the necessary truncation. More recently, the INSERTs and
UPDATEs simply fail, with no real feedback on the nature of the failure.

This changeset addresses the issue in a number of ways:

• On the user-new.php and network/user-new.php panels, don't allow input in excess of the maximum field length.
• In wp_insert_user(), throw an error if the value provided for 'user_login' or 'user_nicename' exceeds the maximum field length.
• In wp_insert_user(), when using 'user_login' to generate a default value for 'user_nicename', ensure that the nicename is properly truncated, even when suffixed for uniqueness (username-2, etc).

Props dipesh.kakadiya, utkarshpatel, tommarshall, boonebgorges.
Fixes #33793.

File:

• trunk/tests/phpunit/tests/user.php (modified) (1 diff)

trunk/tests/phpunit/tests/user.php

@@ -573 +573 @@
 
         $this->assertSame( $user->user_nicename, $updated_user->user_nicename );
+    }
+
+    /**
+     * @ticket 33793
+     */
+    public function test_wp_insert_user_should_reject_user_login_over_60_characters() {
+        $user_login = str_repeat( 'a', 61 );
+        $u = wp_insert_user( array(
+            'user_login' => $user_login,
+            'user_email' => $user_login . '@example.com',
+            'user_pass' => 'password',
+            'user_nicename' => 'something-short',
+        ) );
+
+        $this->assertWPError( $u );
+        $this->assertSame( 'user_login_too_long', $u->get_error_code() );
+    }
+
+    /**
+     * @ticket 33793
+     */
+    public function test_wp_insert_user_should_reject_user_nicename_over_50_characters() {
+        $user_nicename = str_repeat( 'a', 51 );
+        $u = wp_insert_user( array(
+            'user_login' => 'mynicenamehas50chars',
+            'user_email' => $user_nicename . '@example.com',
+            'user_pass' => 'password',
+            'user_nicename' => $user_nicename,
+        ) );
+
+        $this->assertWPError( $u );
+        $this->assertSame( 'user_nicename_too_long', $u->get_error_code() );
+    }
+
+    /**
+     * @ticket 33793
+     */
+    public function test_wp_insert_user_should_not_generate_user_nicename_longer_than_50_chars() {
+        $user_login = str_repeat( 'a', 55 );
+        $u = wp_insert_user( array(
+            'user_login' => $user_login,
+            'user_email' => $user_login . '@example.com',
+            'user_pass' => 'password',
+        ) );
+
+        $this->assertNotEmpty( $u );
+        $user = new WP_User( $u );
+        $expected = str_repeat( 'a', 50 );
+        $this->assertSame( $expected, $user->user_nicename );
+    }
+
+    /**
+     * @ticket 33793
+     */
+    public function test_wp_insert_user_should_not_truncate_to_a_duplicate_user_nicename() {
+        $u1 = $this->factory->user->create( array(
+            'user_nicename' => str_repeat( 'a', 50 ),
+        ) );
+
+        $user_login = str_repeat( 'a', 55 );
+        $u = wp_insert_user( array(
+            'user_login' => $user_login,
+            'user_email' => $user_login . '@example.com',
+            'user_pass' => 'password',
+        ) );
+
+        $this->assertNotEmpty( $u );
+        $user = new WP_User( $u );
+        $expected = str_repeat( 'a', 48 ) . '-2';
+        $this->assertSame( $expected, $user->user_nicename );
+    }
+
+    /**
+     * @ticket 33793
+     */
+    public function test_wp_insert_user_should_not_truncate_to_a_duplicate_user_nicename_when_suffix_has_more_than_one_character() {
+        $users = $this->factory->user->create_many( 9, array(
+            'user_nicename' => str_repeat( 'a', 50 ),
+        ) );
+
+        $user_login = str_repeat( 'a', 55 );
+        $u = wp_insert_user( array(
+            'user_login' => $user_login,
+            'user_email' => $user_login . '@example.com',
+            'user_pass' => 'password',
+        ) );
+
+        $this->assertNotEmpty( $u );
+        $user = new WP_User( $u );
+        $expected = str_repeat( 'a', 47 ) . '-10';
+        $this->assertSame( $expected, $user->user_nicename );
     }