Changeset 52650

Timestamp:

01/29/2022 02:23:59 PM (3 years ago)

Author:

SergeyBiryukov

Message:

Users: Return a WP_Error from wp_insert_user() if the user_url field is too long.

The user_url database field only allows up to 100 characters, and if the value is longer than that, the function should return a proper error message instead of silently failing.

This complements similar checks for user_login and user_nicename fields.

Follow-up to [45], [1575], [32299], [34218], [34626].

Props mkox, sabernhardt, tszming, SergeyBiryukov.
Fixes #44107.

Location:

trunk

Files:

• src/wp-includes/user.php (modified) (1 diff)
• tests/phpunit/tests/user.php (modified) (1 diff)

trunk/src/wp-includes/user.php

@@ -2044 +2044 @@
     $user_url = apply_filters( 'pre_user_url', $raw_user_url );
 
+    if ( mb_strlen( $user_url ) > 100 ) {
+        return new WP_Error( 'user_url_too_long', __( 'User URL may not be longer than 100 characters.' ) );
+    }
+
     $user_registered = empty( $userdata['user_registered'] ) ? gmdate( 'Y-m-d H:i:s' ) : $userdata['user_registered'];
 

trunk/tests/phpunit/tests/user.php

@@ -1002 +1002 @@
 
     /**
+     * @ticket 44107
+     */
+    public function test_wp_insert_user_should_reject_user_url_over_100_characters() {
+        $user_url = str_repeat( 'a', 101 );
+        $u        = wp_insert_user(
+            array(
+                'user_login' => 'test',
+                'user_email' => 'test@example.com',
+                'user_pass'  => 'password',
+                'user_url'   => $user_url,
+            )
+        );
+
+        $this->assertWPError( $u );
+        $this->assertSame( 'user_url_too_long', $u->get_error_code() );
+    }
+
+    /**
      * @ticket 28004
      */