Changeset 40594

Timestamp:

05/09/2017 04:32:53 PM (7 years ago)

Author:

jeremyfelt

Message:

Multisite: Validate email before checking against banned domains.

Previously, an invalid email could result in an undefined index when attempting to determine the email domain.

Props ocean90.
See #39915.

Location:

trunk

Files:

• src/wp-includes/ms-functions.php (modified) (2 diffs)
• tests/phpunit/tests/multisite/wpmuValidateUserSignup.php (modified) (1 diff)

trunk/src/wp-includes/ms-functions.php

@@ -443 +443 @@
     }
 
-    if ( is_email_address_unsafe( $user_email ) )
-        $errors->add('user_email',  __('You cannot use that email address to signup. We are having problems with them blocking some of our email. Please use another email provider.'));
+    if ( ! is_email( $user_email ) ) {
+        $errors->add( 'user_email', __( 'Please enter a valid email address.' ) );
+    } elseif ( is_email_address_unsafe( $user_email ) ) {
+        $errors->add( 'user_email', __( 'You cannot use that email address to signup. We are having problems with them blocking some of our email. Please use another email provider.' ) );
+    }
 
     if ( strlen( $user_name ) < 4 )
@@ -456 +459 @@
     if ( preg_match( '/^[0-9]*$/', $user_name ) )
         $errors->add('user_name', __('Sorry, usernames must have letters too!'));
-
-    if ( !is_email( $user_email ) )
-        $errors->add('user_email', __( 'Please enter a valid email address.' ) );
 
     $limited_email_domains = get_site_option( 'limited_email_domains' );

trunk/tests/phpunit/tests/multisite/wpmuValidateUserSignup.php

@@ -123 +123 @@
     }
 
+    public function test_invalid_email_address_with_no_banned_domains_results_in_error() {
+        $valid = wpmu_validate_user_signup( 'validusername', 'invalid-email' );
+
+        $this->assertContains( 'user_email', $valid['errors']->get_error_codes() );
+    }
+
+    public function test_invalid_email_address_with_banned_domains_results_in_error() {
+        update_site_option( 'banned_email_domains', "bar.com" );
+        $valid = wpmu_validate_user_signup( 'validusername', 'invalid-email' );
+        delete_site_option( 'banned_email_domains' );
+
+        $this->assertContains( 'user_email', $valid['errors']->get_error_codes() );
+    }
+
+    public function test_incomplete_email_address_with_no_banned_domains_results_in_error() {
+        $valid = wpmu_validate_user_signup( 'validusername', 'incomplete@email' );
+
+        $this->assertContains( 'user_email', $valid['errors']->get_error_codes() );
+    }
+
+    public function test_valid_email_address_matching_banned_domain_results_in_error() {
+        update_site_option( 'banned_email_domains', "bar.com" );
+        $valid = wpmu_validate_user_signup( 'validusername', 'email@bar.com' );
+        delete_site_option( 'banned_email_domains' );
+
+        $this->assertContains( 'user_email', $valid['errors']->get_error_codes() );
+    }
+
+    public function test_valid_email_address_not_matching_banned_domain_returns_in_success() {
+        update_site_option( 'banned_email_domains', "bar.com" );
+        $valid = wpmu_validate_user_signup( 'validusername', 'email@example.com' );
+        delete_site_option( 'banned_email_domains' );
+
+        $this->assertNotContains( 'user_email', $valid['errors']->get_error_codes() );
+    }
 }