Changeset 49118

Timestamp:

10/10/2020 04:49:35 PM (6 years ago)

Author:

adamsilverstein

Message:

Users: prevent saving empty passwords, trim space from password ends on save.

Fix an issue where users could save a password with only spaces, or spaces at the beginning or end of their password, preventing them from logging in.

Props ronakganatra, 1naveengiri, ajensen, oolleegg55, bookdude13, nrqsnchz, aristath.
Fixes #42766.

Location:

trunk

Files:

• src/js/_enqueues/admin/user-profile.js (modified) (1 diff)
• src/wp-admin/includes/user.php (modified) (1 diff)
• tests/phpunit/tests/user.php (modified) (2 diffs)

trunk/src/js/_enqueues/admin/user-profile.js

@@ -216 +216 @@
 
                 $('#pass-strength-result').removeClass('short bad good strong empty');
-                if ( ! pass1 ) {
+                if ( ! pass1 || '' ===  pass1.trim() ) {
                         $( '#pass-strength-result' ).addClass( 'empty' ).html( ' ' );
                         return;

trunk/src/wp-admin/includes/user.php

@@ -48 +48 @@
         $pass2 = '';
         if ( isset( $_POST['pass1'] ) ) {
-                $pass1 = $_POST['pass1'];
+                $pass1 = trim( $_POST['pass1'] );
         }
         if ( isset( $_POST['pass2'] ) ) {
-                $pass2 = $_POST['pass2'];
+                $pass2 = trim( $_POST['pass2'] );
         }
 

trunk/tests/phpunit/tests/user.php

@@ -1452 +1452 @@
          *
          * @ticket 35715
+         * @ticket 42766
          */
         function test_edit_user_blank_pw() {
@@ -1492 +1493 @@
                 $this->assertSame( 'nickname_updated', $user->nickname );
 
+                // Check not to change an old password if a new password contains only spaces. Ticket #42766
+                $user           = get_user_by( 'ID', $user_id );
+                $old_pass       = $user->user_pass;
+                $_POST['pass2'] = '  ';
+                $_POST['pass1'] = '  ';
+
+                $user_id = edit_user( $user_id );
+                $user    = get_user_by( 'ID', $user_id );
+
+                $this->assertInternalType( 'int', $user_id );
+                $this->assertEquals( $old_pass, $user->user_pass );
+
                 // Check updating user with missing second password.
                 $_POST['nickname'] = 'nickname_updated2';