Changeset 60288

Timestamp:

06/06/2025 08:29:33 AM (6 weeks ago)

Author:

peterwilsoncc

Message:

Users: Prevent creating of empty usernames after sanitization.

Introduces a check in wp_insert_user() to ensure the username doesn't have a length of zero after sanitization removes invalid characters.

Props kalpeshh, missveronicatv, rayhatron, rinkalpagdar, sergeybiryukov, thehercules.
Fixes #57635.

File:

• trunk/src/wp-includes/user.php (modified) (1 diff)

trunk/src/wp-includes/user.php

@@ -2287 +2287 @@
     $user_nicename = apply_filters( 'pre_user_nicename', $user_nicename );
 
-    if ( mb_strlen( $user_nicename ) > 50 ) {
+    // Check if the sanitized nicename is empty.
+    if ( empty( $user_nicename ) ) {
+        return new WP_Error( 'empty_user_nicename', __( 'Cannot create a user with an empty nicename.' ) );
+    } elseif ( mb_strlen( $user_nicename ) > 50 ) {
         return new WP_Error( 'user_nicename_too_long', __( 'Nicename may not be longer than 50 characters.' ) );
     }