Changeset 55358

Timestamp:

02/17/2023 08:08:19 AM (20 months ago)

Author:

adamsilverstein

Message:

Login and Registration: prevent registering with username that matches previous user email.

When registering a new user, check that no existing user has an email matching the username.

Prevents a login name collision when one user registers with the email address user@… and a second user tries to register with the username user@….

Props buutqn, dunhakdis, roytanck, ajayver.
Fixes #57394.

Location:

trunk

Files:

• src/wp-includes/user.php (modified) (2 diffs)
• tests/phpunit/tests/user.php (modified) (1 diff)

trunk/src/wp-includes/user.php

@@ -2124 +2124 @@
     }
 
+    // Username must be unique.
     if ( ! $update && username_exists( $user_login ) ) {
         return new WP_Error( 'existing_user_login', __( 'Sorry, that username already exists!' ) );
+    }
+
+    // Username must not match an existing user email.
+    if ( email_exists( $user_login ) ) {
+        return new WP_Error( 'existing_user_login_as_email', __( 'Sorry, that username is not available.' ) );
     }
 
@@ -3341 +3347 @@
     } elseif ( username_exists( $sanitized_user_login ) ) {
         $errors->add( 'username_exists', __( '<strong>Error:</strong> This username is already registered. Please choose another one.' ) );
-
+    } elseif ( email_exists( $sanitized_user_login ) ) {
+        $errors->add( 'username_exists_as_email', __( '<strong>Error:</strong> This username is not available. Please choose another one.' ) );
     } else {
         /** This filter is documented in wp-includes/user.php */

trunk/tests/phpunit/tests/user.php

@@ -936 +936 @@
 
     /**
+     * @ticket 57394
+     */
+    public function test_wp_insert_user_should_reject_username_that_matches_existing_user_email() {
+        $existing_email = get_option( 'admin_email' );
+        $username       = wp_insert_user(
+            array(
+                'user_login'    => $existing_email,
+                'user_email'    => 'whatever@example.com',
+                'user_pass'     => 'whatever',
+                'user_nicename' => 'whatever',
+            )
+        );
+
+        $this->assertWPError( $username );
+        $this->assertSame( 'existing_user_login_as_email', $username->get_error_code() );
+    }
+
+    /**
      * @ticket 33793
      */