WordPress.org
Get WordPress

Make WordPress Core

Changeset 43459 for branches/4.9


Ignore:
Timestamp:
07/16/2018 02:23:26 PM (6 years ago)
Author:
SergeyBiryukov
Message:

Privacy: Use consistent values for the site name and URL used in notification emails.

The functions send_confirmation_on_profile_email(), _wp_privacy_send_request_confirmation_notification(), _wp_privacy_send_erasure_fulfillment_notification(), and wp_send_user_request() all include a title and URL indicating the current site. However, so far they have dealt with those values inconsistently, sometimes using the site values, other times using the network values if in a multisite. This changeset ensures that only the current site is taken into account in all cases and that special characters in the site name are consistently decoded.

Props subrataemfluence, desrosj.
Merges [43388], [43390], and [43435] to the 4.9 branch.
Fixes #44396.

Location:
branches/4.9
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • branches/4.9

  • branches/4.9/src/wp-admin/includes/file.php

    r43448 r43459  
    21002100    $email_address = $request->email;
    21012101    $export_file_url = get_post_meta( $request_id, '_export_file_url', true );
    2102     $site_name = is_multisite() ? get_site_option( 'site_name' ) : get_option( 'blogname' );
    2103     $site_url = network_home_url();
     2102    $site_name = wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES );
     2103    $site_url = home_url();
    21042104
    21052105    $content = str_replace( '###EXPIRATION###', $expiration_date, $content );
    21062106    $content = str_replace( '###LINK###', esc_url_raw( $export_file_url ), $content );
    21072107    $content = str_replace( '###EMAIL###', $email_address, $content );
    2108     $content = str_replace( '###SITENAME###', wp_specialchars_decode( $site_name, ENT_QUOTES ), $content );
     2108    $content = str_replace( '###SITENAME###', $site_name, $content );
    21092109    $content = str_replace( '###SITEURL###', esc_url_raw( $site_url ), $content );
    21102110
    … …  
    21132113        sprintf(
    21142114            __( '[%s] Personal Data Export' ),
    2115             wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES )
     2115            $site_name
    21162116        ),
    21172117        $content

  • branches/4.9/src/wp-includes/user.php

    r43456 r43459  
    26582658        update_user_meta( $current_user->ID, '_new_email', $new_user_email );
    26592659
    2660         if ( is_multisite() ) {
    2661             $sitename = get_site_option( 'site_name' );
    2662         } else {
    2663             $sitename = get_option( 'blogname' );
    2664         }
     2660        $sitename = wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES );
    26652661
    26662662        /* translators: Do not translate USERNAME, ADMIN_URL, EMAIL, SITENAME, SITEURL: those are placeholders. */
    … …  
    27072703        $content = str_replace( '###ADMIN_URL###', esc_url( admin_url( 'profile.php?newuseremail=' . $hash ) ), $content );
    27082704        $content = str_replace( '###EMAIL###', $_POST['email'], $content );
    2709         $content = str_replace( '###SITENAME###', wp_specialchars_decode( $sitename, ENT_QUOTES ), $content );
    2710         $content = str_replace( '###SITEURL###', network_home_url(), $content );
    2711 
    2712         wp_mail( $_POST['email'], sprintf( __( '[%s] New Email Address' ), wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES ) ), $content );
     2705        $content = str_replace( '###SITENAME###', $sitename, $content );
     2706        $content = str_replace( '###SITEURL###', home_url(), $content );
     2707
     2708        wp_mail( $_POST['email'], sprintf( __( '[%s] New Email Address' ), $sitename ), $content );
    27132709
    27142710        $_POST['email'] = $current_user->user_email;
    … …  
    29202916        'description' => $action_description,
    29212917        'manage_url'  => $manage_url,
    2922         'sitename'    => get_option( 'blogname' ),
     2918        'sitename'    => wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES ),
    29232919        'siteurl'     => home_url(),
    29242920        'admin_email' => $admin_email,
    … …  
    29722968    $content = apply_filters( 'user_confirmed_action_email_content', $email_text, $email_data );
    29732969
    2974     $content = str_replace( '###SITENAME###', wp_specialchars_decode( $email_data['sitename'], ENT_QUOTES ), $content );
     2970    $content = str_replace( '###SITENAME###', $email_data['sitename'], $content );
    29752971    $content = str_replace( '###USER_EMAIL###', $email_data['user_email'], $content );
    29762972    $content = str_replace( '###DESCRIPTION###', $email_data['description'], $content );
    … …  
    29782974    $content = str_replace( '###SITEURL###', esc_url_raw( $email_data['siteurl'] ), $content );
    29792975
    2980     $blogname = wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES );
    2981 
    29822976    $subject = sprintf(
    29832977        /* translators: 1: Site name. 2: Name of the confirmed action. */
    29842978        __( '[%1$s] Action Confirmed: %2$s' ),
    2985         $blogname,
     2979        $email_data['sitename'],
    29862980        $action_description
    29872981    );
    … …  
    29932987     *
    29942988     * @param string $subject    The email subject.
    2995      * @param string $blogname   The name of the site.
     2989     * @param string $sitename   The name of the site.
    29962990     * @param array  $email_data {
    29972991     *     Data relating to the account action email.
    … …  
    30063000     * }
    30073001     */
    3008     $subject = apply_filters( 'user_request_confirmed_email_subject', $subject, $blogname, $email_data );
     3002    $subject = apply_filters( 'user_request_confirmed_email_subject', $subject, $email_data['sitename'], $email_data );
    30093003
    30103004    $email_sent = wp_mail( $email_data['admin_email'], $subject, $content );
    … …  
    30363030        return;
    30373031    }
    3038 
    3039     $subject = sprintf(
    3040         /* translators: %s Site name. */
    3041         __( '[%s] Erasure Request Fulfilled' ),
    3042         wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES )
    3043     );
    30443032
    30453033    /**
    … …  
    30573045        'message_recipient'  => $user_email,
    30583046        'privacy_policy_url' => get_privacy_policy_url(),
    3059         'sitename'           => get_option( 'blogname' ),
     3047        'sitename'           => wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES ),
    30603048        'siteurl'            => home_url(),
     3049    );
     3050
     3051    $subject  = sprintf(
     3052        /* translators: %s: Site name. */
     3053        __( '[%s] Erasure Request Fulfilled' ),
     3054        $email_data['sitename']
    30613055    );
    30623056
    … …  
    31203114    $content = apply_filters( 'user_confirmed_action_email_content', $email_text, $email_data );
    31213115
    3122     $content = str_replace( '###SITENAME###', wp_specialchars_decode( $email_data['sitename'], ENT_QUOTES ), $content );
     3116    $content = str_replace( '###SITENAME###', $email_data['sitename'], $content );
    31233117    $content = str_replace( '###PRIVACY_POLICY_URL###', $email_data['privacy_policy_url'], $content );
    31243118    $content = str_replace( '###SITEURL###', esc_url_raw( $email_data['siteurl'] ), $content );
    … …  
    32833277            'confirm_key' => wp_generate_user_request_key( $request_id ),
    32843278        ), wp_login_url() ),
    3285         'sitename'    => is_multisite() ? get_site_option( 'site_name' ) : get_option( 'blogname' ),
    3286         'siteurl'     => network_home_url(),
     3279        'sitename'    => wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES ),
     3280        'siteurl'     => home_url(),
    32873281    );
    32883282
    … …  
    33353329    $content = str_replace( '###CONFIRM_URL###', esc_url_raw( $email_data['confirm_url'] ), $content );
    33363330    $content = str_replace( '###EMAIL###', $email_data['email'], $content );
    3337     $content = str_replace( '###SITENAME###', wp_specialchars_decode( $email_data['sitename'], ENT_QUOTES ), $content );
     3331    $content = str_replace( '###SITENAME###', $email_data['sitename'], $content );
    33383332    $content = str_replace( '###SITEURL###', esc_url_raw( $email_data['siteurl'] ), $content );
    33393333
    3340     $blogname = wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES );
    3341 
    33423334    /* translators: Privacy data request subject. 1: Site name, 2: Name of the action */
    3343     $subject = sprintf( __( '[%1$s] Confirm Action: %2$s' ), $blogname, $email_data['description'] );
     3335    $subject = sprintf( __( '[%1$s] Confirm Action: %2$s' ), $email_data['sitename'], $email_data['description'] );
    33443336
    33453337    /**
    … …  
    33493341     *
    33503342     * @param string $subject    The email subject.
    3351      * @param string $blogname   The name of the site.
     3343     * @param string $sitename   The name of the site.
    33523344     * @param array  $email_data {
    33533345     *     Data relating to the account action email.
    … …  
    33613353     * }
    33623354     */
    3363     $subject = apply_filters( 'user_request_action_email_subject', $subject, $blogname, $email_data );
     3355    $subject = apply_filters( 'user_request_action_email_subject', $subject, $email_data['sitename'], $email_data );
    33643356
    33653357    return wp_mail( $email_data['email'], $subject, $content );

  • branches/4.9/tests/phpunit/tests/user.php

    r43117 r43459  
    14251425        reset_phpmailer_instance();
    14261426
    1427         // Give the site and blog a name containing HTML entities
    1428         update_site_option( 'site_name', ''Test' site's "name" has <html entities> &' );
     1427        // Give the site a name containing HTML entities
    14291428        update_option( 'blogname', ''Test' blog's "name" has <html entities> &' );
    14301429
    … …  
    14441443
    14451444        // Assert that HTML entites have been decoded in body and subject
    1446         if ( is_multisite() ) {
    1447             $this->assertContains( '\'Test\' site\'s "name" has <html entities> &', $email->body, 'Email body does not contain the decoded HTML entities' );
    1448             $this->assertNotContains( '&#039;Test&#039; site&#039;s &quot;name&quot; has &lt;html entities&gt; &amp;', $email->body, 'Email body does contains HTML entities' );
    1449         }
    1450 
    14511445        $this->assertContains( '\'Test\' blog\'s "name" has <html entities> &', $email->subject, 'Email subject does not contain the decoded HTML entities' );
    14521446        $this->assertNotContains( '&#039;Test&#039; blog&#039;s &quot;name&quot; has &lt;html entities&gt; &amp;', $email->subject, 'Email subject does contains HTML entities' );
Note: See TracChangeset for help on using the changeset viewer.