Changeset 44641

Timestamp:

01/17/2019 09:24:47 PM (6 years ago)

Author:

desrosj

Message:

REST API: Allow a user to change the letter casing of their email.

When a PUT request is performed to update a user, a rest_user_invalid_email error is incorrectly being returned when the email exists with different letter casing, even if it belongs to the user being updated. email_exists() performs a case insensitive lookup, but the conditional statement following that lookup was performing a strict comparison between the new email and the user’s current email.

This changes that comparison to instead compare the user ID returned by email_exists() with the user ID being updated. This more closely matches the logic used in edit_user() and allows a user to change the letter casing of their email.

Props fuchsws, rachelbaker, desrosj.
Fixes #44672.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-users-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -642 +642 @@
         }
 
-        if ( email_exists( $request['email'] ) && $request['email'] !== $user->user_email ) {
+        $owner_id = email_exists( $request['email'] );
+
+        if ( $owner_id && $owner_id !== $id ) {
             return new WP_Error( 'rest_user_invalid_email', __( 'Invalid email address.' ), array( 'status' => 400 ) );
         }

trunk/tests/phpunit/tests/rest-api/rest-users-controller.php

@@ -1492 +1492 @@
         $this->assertInstanceOf( 'WP_Error', $response->as_error() );
         $this->assertEquals( 'rest_user_invalid_email', $response->as_error()->get_error_code() );
+    }
+
+    /**
+     * @ticket 44672
+     */
+    public function test_update_item_existing_email_case() {
+        wp_set_current_user( self::$editor );
+
+        $user = get_userdata( self::$editor );
+
+        $updated_email_with_case_change = ucwords( $user->user_email, '@' );
+
+        $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/users/%d', self::$editor ) );
+        $request->set_param( 'email', $updated_email_with_case_change );
+        $response = rest_get_server()->dispatch( $request );
+        $data     = $response->get_data();
+
+        $this->assertEquals( 200, $response->get_status() );
+        $this->assertEquals( $updated_email_with_case_change, $data['email'] );
+    }
+
+    /**
+     * @ticket 44672
+     */
+    public function test_update_item_existing_email_case_not_own() {
+        wp_set_current_user( self::$editor );
+
+        $user       = get_userdata( self::$editor );
+        $subscriber = get_userdata( self::$subscriber );
+
+        $updated_email_with_case_change = ucwords( $subscriber->user_email, '@' );
+
+        $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/users/%d', self::$editor ) );
+        $request->set_param( 'email', $updated_email_with_case_change );
+        $response = rest_get_server()->dispatch( $request );
+        $data     = $response->get_data();
+
+        $this->assertEquals( 400, $response->get_status() );
+        $this->assertSame( 'rest_user_invalid_email', $data['code'] );
     }