Changeset 35189

Timestamp:

10/15/2015 05:42:05 AM (9 years ago)

Author:

SergeyBiryukov

Message:

Users: Add 'illegal_user_logins' filter to allow certain usernames to be blacklisted.

Props danielbachhuber, chriscct7, crazycoolcam, SergeyBiryukov.
Fixes #27317.

Location:

trunk

Files:

• src/wp-admin/includes/user.php (modified) (1 diff)
• src/wp-includes/ms-functions.php (modified) (1 diff)
• src/wp-includes/user-functions.php (modified) (1 diff)
• tests/phpunit/tests/user.php (modified) (1 diff)

trunk/src/wp-admin/includes/user.php

@@ -142 +142 @@
     if ( !$update && username_exists( $user->user_login ) )
         $errors->add( 'user_login', __( '<strong>ERROR</strong>: This username is already registered. Please choose another one.' ));
+
+    /** This filter is documented in wp-includes/user-functions.php */
+    $usernames = apply_filters( 'illegal_user_logins', array() );
+    if ( in_array( $user->user_login, $usernames ) ) {
+        $errors->add( 'illegal_user_login', __( '<strong>ERROR</strong>: Sorry, that username is not allowed.' ) );
+    }
 
     /* checking email address */

trunk/src/wp-includes/ms-functions.php

@@ -428 +428 @@
         add_site_option( 'illegal_names', $illegal_names );
     }
-    if ( in_array( $user_name, $illegal_names ) )
-        $errors->add('user_name',  __( 'That username is not allowed.' ) );
+    if ( in_array( $user_name, $illegal_names ) ) {
+        $errors->add( 'user_name',  __( 'Sorry, that username is not allowed.' ) );
+    }
+
+    /** This filter is documented in wp-includes/user-functions.php */
+    if ( in_array( $user_name, apply_filters( 'illegal_user_logins', array() ) ) ) {
+        $errors->add( 'user_name',  __( 'Sorry, that username is not allowed.' ) );
+    }
 
     if ( is_email_address_unsafe( $user_email ) )

trunk/src/wp-includes/user-functions.php

@@ -1316 +1316 @@
     }
 
+    /**
+     * Filter the list of blacklisted usernames.
+     *
+     * @since 4.4.0
+     *
+     * @param array $usernames Array of blacklisted usernames.
+     */
+    if ( in_array( $user_login, apply_filters( 'illegal_user_logins', array() ) ) ) {
+        return new WP_Error( 'illegal_user_login', __( 'Sorry, that username is not allowed.' ) );
+    }   
+
     /*
      * If a nicename is provided, remove unsafe user characters before using it.

trunk/tests/phpunit/tests/user.php

@@ -601 +601 @@
             }
         }
+    }
+
+    /**
+     * @ticket 27317
+     */
+    function test_illegal_user_logins_single() {
+        $user_data = array(
+            'user_login' => 'testuser',
+            'user_email' => 'testuser@example.com',
+            'user_pass'  => wp_generate_password(),
+        );
+
+        add_filter( 'illegal_user_logins', array( $this, '_illegal_user_logins' ) );
+
+        $response = wp_insert_user( $user_data );
+        $this->assertInstanceOf( 'WP_Error', $response );
+        $this->assertEquals( 'illegal_user_login', $response->get_error_code() );
+
+        remove_filter( 'illegal_user_logins', array( $this, '_illegal_user_logins' ) );
+
+        $user_id = wp_insert_user( $user_data );
+        $user = get_user_by( 'id', $user_id );
+        $this->assertInstanceOf( 'WP_User', $user );
+    }
+
+    /**
+     * @ticket 27317
+     */
+    function test_illegal_user_logins_multisite() {
+        if ( ! is_multisite() ) {
+            return;
+        }
+
+        $user_data = array(
+            'user_login' => 'testuser',
+            'user_email' => 'testuser@example.com',
+        );
+
+        add_filter( 'illegal_user_logins', array( $this, '_illegal_user_logins' ) );
+
+        $response = wpmu_validate_user_signup( $user_data['user_login'], $user_data['user_email'] );
+        $this->assertInstanceOf( 'WP_Error', $response['errors'] );
+        $this->assertEquals( 'user_name', $response['errors']->get_error_code() );
+
+        remove_filter( 'illegal_user_logins', array( $this, '_illegal_user_logins' ) );
+
+        $response = wpmu_validate_user_signup( $user_data['user_login'], $user_data['user_email'] );
+        $this->assertInstanceOf( 'WP_Error', $response['errors'] );
+        $this->assertEquals( 0, count( $response['errors']->get_error_codes() ) );
+    }
+
+    function _illegal_user_logins() {
+        return array( 'testuser' ); 
     }