Changeset 40595

Timestamp:

05/09/2017 04:54:52 PM (7 years ago)

Author:

jeremyfelt

Message:

Multisite: Check only valid looking emails against banned domain list.

If an email address is missing an @, we can't assume enough to check it against a list of domain names.

Additional validation of email should happen in is_email() before being passed to is_email_address_unsafe().

Fixes #39915.

Location:

trunk

Files:

• src/wp-includes/ms-functions.php (modified) (1 diff)
• tests/phpunit/tests/multisite/isEmailAddressUnsafe.php (modified) (1 diff)

trunk/src/wp-includes/ms-functions.php

@@ -355 +355 @@
     $is_email_address_unsafe = false;
 
-    if ( $banned_names && is_array( $banned_names ) ) {
+    if ( $banned_names && is_array( $banned_names ) && false !== strpos( $user_email, '@', 1 ) ) {
         $banned_names = array_map( 'strtolower', $banned_names );
         $normalized_email = strtolower( $user_email );

trunk/tests/phpunit/tests/multisite/isEmailAddressUnsafe.php

@@ -121 +121 @@
         );
     }
+
+    public function test_email_with_only_top_level_domain_returns_safe() {
+        update_site_option( 'banned_email_domains', 'bar.com' );
+        $safe = is_email_address_unsafe( 'email@localhost' );
+        delete_site_option( 'banned_email_domains' );
+
+        $this->assertFalse( $safe );
+    }
+
+    public function test_invalid_email_without_domain_returns_safe() {
+        update_site_option( 'banned_email_domains', 'bar.com' );
+        $safe = is_email_address_unsafe( 'invalid-email' );
+        delete_site_option( 'bar.com' );
+
+        $this->assertFalse( $safe );
+    }
 }