Changeset 55301

Timestamp:

02/09/2023 01:29:42 AM (22 months ago)

Author:

SergeyBiryukov

Message:

Login and Registration: Set correct default values in wp_signon().

The $credentials['user_login'] and $credentials['user_password'] parameters are passed by reference to the wp_authenticate action, and are at that point ​created as null if they don't exist in the array.

This commit sets those values to an empty string, resolving two PHP 8.1 deprecation notices:

• One from preg_replace() in wp_strip_all_tags() via sanitize_user() in wp_authenticate():

  Deprecated: preg_replace(): Passing null to parameter #3 ($subject) of type array|string is deprecated
  

• One from trim() in wp_authenticate() itself:

  Deprecated: trim(): Passing null to parameter #1 ($string) of type string is deprecated
  

Includes documenting the $credentials parameter using hash notation.

Follow-up to [6643], [37697].

Props lenasterg, TobiasBg, ocean90, afragen, lkraav, SergeyBiryukov.
Fixes #56850.

Location:

trunk

Files:

• src/wp-includes/user.php (modified) (2 diffs)
• tests/phpunit/tests/auth.php (modified) (1 diff)

trunk/src/wp-includes/user.php

@@ -27 +27 @@
  * @global string $auth_secure_cookie
  *
- * @param array       $credentials   Optional. User info in order to sign on.
+ * @param array       $credentials {
+ *     Optional. User info in order to sign on.
+ *
+ *     @type string $user_login    Username.
+ *     @type string $user_password User password.
+ *     @type bool   $remember      Whether to 'remember' the user. Increases the time
+ *                                 that the cookie will be kept. Default false.
+ * }
  * @param string|bool $secure_cookie Optional. Whether to use secure cookie.
  * @return WP_User|WP_Error WP_User on success, WP_Error on failure.
@@ -33 +40 @@
 function wp_signon( $credentials = array(), $secure_cookie = '' ) {
     if ( empty( $credentials ) ) {
-        $credentials = array(); // Back-compat for plugins passing an empty string.
+        $credentials = array(
+            'user_login'    => '',
+            'user_password' => '',
+            'remember'      => false,
+        );
 
         if ( ! empty( $_POST['log'] ) ) {

trunk/tests/phpunit/tests/auth.php

@@ -443 +443 @@
         $_POST['pwd'] = $user_args['user_pass'];
         $this->assertInstanceOf( 'WP_User', wp_signon() );
+    }
+
+    /**
+     * Tests that PHP 8.1 "passing null to non-nullable" deprecation notices
+     * are not thrown when `user_login` and `user_password` parameters are empty.
+     *
+     * The notices that we should not see:
+     * `Deprecated: preg_replace(): Passing null to parameter #3 ($subject) of type array|string is deprecated`.
+     * `Deprecated: trim(): Passing null to parameter #1 ($string) of type string is deprecated`.
+     *
+     * @ticket 56850
+     */
+    public function test_wp_signon_does_not_throw_deprecation_notices_with_default_parameters() {
+        $error = wp_signon();
+        $this->assertWPError( $error, 'The result should be an instance of WP_Error.' );
+
+        $error_codes = $error->get_error_codes();
+        $this->assertContains( 'empty_username', $error_codes, 'The "empty_username" error code should be present.' );
+        $this->assertContains( 'empty_password', $error_codes, 'The "empty_password" error code should be present.' );
     }