Changeset 3481

Timestamp:

01/25/2006 03:09:16 AM (19 years ago)

Author:

ryan

Message:

Username sanitization cleanups.

Location:

trunk

Files:

• wp-admin/admin-functions.php (modified) (3 diffs)
• wp-includes/functions-formatting.php (modified) (2 diffs)
• wp-includes/registration-functions.php (modified) (2 diffs)
• wp-register.php (modified) (1 diff)

trunk/wp-admin/admin-functions.php

@@ -330 +330 @@
 
 function edit_user($user_id = 0) {
-    global $current_user, $wp_roles;
+    global $current_user, $wp_roles, $wpdb;
 
     if ($user_id != 0) {
@@ -336 +336 @@
         $user->ID = $user_id;
         $userdata = get_userdata($user_id);
-        $user->user_login = $userdata->user_login;
+        $user->user_login = $wpdb->escape($userdata->user_login);
     } else {
         $update = false;
@@ -406 +406 @@
     if (!empty ($pass1))
         $user->user_pass = $pass1;
+
+    if ( !validate_username($user->user_login) )
+        $errors['user_login'] = __('<strong>ERROR</strong>: This username is invalid.  Please enter a valid username.');
 
     if (!$update && username_exists($user->user_login))

trunk/wp-includes/functions-formatting.php

@@ -266 +266 @@
 }
 
-function sanitize_user( $username ) {
+function sanitize_user( $username, $strict = false ) {
     $raw_username = $username;
     $username = strip_tags($username);
@@ -272 +272 @@
     $username = preg_replace('|%([a-fA-F0-9][a-fA-F0-9])|', '', $username);
     $username = preg_replace('/&.+?;/', '', $username); // Kill entities
-    return apply_filters('sanitize_user', $username, $raw_username);
+
+    // If strict, reduce to ASCII for max portability.
+    if ( $strict )
+        $username = preg_replace('|[^a-z0-9 _.-@]|i', '', $username);
+
+    return apply_filters('sanitize_user', $username, $raw_username, $strict);
 }
 

trunk/wp-includes/registration-functions.php

@@ -9 +9 @@
 
     return null;
+}
+
+function validate_username( $username ) {
+    $name = sanitize_user($username, true);
+    $valid = true;
+
+    if ( $name != $username )
+        $valid = false; 
+
+    return apply_filters('validate_username', $valid, $username);   
 }
 
@@ -25 +35 @@
     }
     
+    $user_login = sanitize_user($user_login, true);
+
     if ( empty($user_nicename) )
         $user_nicename = sanitize_title( $user_login );

trunk/wp-register.php

@@ -28 +28 @@
     }
 
-  if ( username_exists( $user_login ) )
+    if ( ! validate_username($user_login) )
+        $errors['user_login'] = __('<strong>ERROR</strong>: This username is invalid.  Please enter a valid username.');
+
+    if ( username_exists( $user_login ) )
         $errors['user_login'] = __('<strong>ERROR</strong>: This username is already registered, please choose another one.');