Changeset 63016

Timestamp:

08/05/2026 01:33:06 AM (6 weeks ago)

Author:

westonruter

Message:

Networks and Sites: Improve user autocomplete search term handling.

In wp_ajax_autocomplete_user(), unslash and sanitize the term request parameter before it is passed to get_users(). Unslashing fixes searching for an email address containing an apostrophe (valid per is_email()), which could previously never match because wp_magic_quotes() added a slash which wpdb::esc_like() then escaped as a literal. Note that the raw term was already safely handled in the user query, since WP_User_Query passes the search term through wpdb::prepare(), so this is a hardening and correctness fix rather than a security fix.

Additionally, a missing, non-string, or empty term now short-circuits with a 0 response instead of returning an empty array, avoiding a PHP warning and needless user queries. Asterisks are also trimmed from the term given that wildcards are appended to it; a term consisting only of asterisks previously resulted in an empty search which matched all users on the network.

Also introduce the Tests_Ajax_wpAjaxAutocompleteUser test class covering the Ajax action's search behavior, input handling, and capability checks.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/11530.
Follow-up to r19897, r20279.

Props rajeshcp, wildworks, westonruter, liaison, gaurangsondagar, vgnavada, saadtajik.
Fixes #65051.

Location:

trunk

Files:

• src/wp-admin/includes/ajax-actions.php (modified) (3 diffs)
• tests/phpunit/tests/ajax/wpAjaxAutocompleteUser.php (added)

trunk/src/wp-admin/includes/ajax-actions.php

@@ -286 +286 @@
  *
  * @since 3.4.0
+ * @since 7.1.0 The search term is now sanitized, and a missing, non-string,
+ *              or empty term results in a `0` response instead of an empty array.
+ *
+ * @return never
  */
 function wp_ajax_autocomplete_user() {
@@ -298 +302 @@
 
         $return = array();
+
+        // Obtain the search term, and short-circuit missing/invalid search term.
+        if ( ! isset( $_REQUEST['term'] ) || ! is_string( $_REQUEST['term'] ) ) {
+                wp_die( 0 );
+        }
+        /*
+         * Asterisks are trimmed since wildcards are appended below. Without this, a
+         * term consisting only of asterisks would result in an empty search that
+         * matches all users.
+         */
+        $term = trim( sanitize_text_field( wp_unslash( $_REQUEST['term'] ) ), '*' );
+        if ( '' === $term ) {
+                wp_die( 0 );
+        }
 
         /*
@@ -343 +361 @@
                 array(
                         'blog_id'        => false,
-                        'search'         => '*' . $_REQUEST['term'] . '*',
+                        'search'         => '*' . $term . '*',
                         'include'        => $include_blog_users,
                         'exclude'        => $exclude_blog_users,