Changeset 44611

Timestamp:

01/16/2019 04:26:48 AM (6 years ago)

Author:

pento

Message:

Users: Add extra checking to wp_new_user_notification().

Prevent a notification from being sent when an unrecognised value is passed in the $notify parameter.

Props cthreelabs, 360zen.
Fixes #44293.

Location:

trunk

Files:

• src/wp-includes/pluggable.php (modified) (1 diff)
• tests/phpunit/tests/user.php (modified) (1 diff)

trunk/src/wp-includes/pluggable.php

@@ -1895 +1895 @@
         }
 
+        // Accepts only 'user', 'admin' , 'both' or default '' as $notify
+        if ( ! in_array( $notify, array( 'user', 'admin', 'both', '' ), true ) ) {
+            return;
+        }
+
         global $wpdb, $wp_hasher;
         $user = get_userdata( $user_id );

trunk/tests/phpunit/tests/user.php

@@ -1170 +1170 @@
                 true,
             ),
+            array(
+                'THIS IS NOT A SUPPORTED NOTIFICATION TYPE',
+                false,
+                false,
+            ),
         );
     }