Changeset 63112 for branches/5.0/src/wp-admin/includes/user.php

Timestamp:

08/06/2026 07:54:07 PM (7 weeks ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.0.3 security fixes to the 5.0 branch.

• Users: Ensure a proper email address is used before sending email confirmations.
• Formatting: Prevent stack overflow in safecss_filter_attr.
• Multisite: Enforce the active signup policy for existing users.
• HTTP API: Improve compliance with IPv4 Special-Purpose Address Space.
• Users: Prevent Usernames from mangling HTML
• Canonical: Only redirect for publicly viewable post types.
• Administration: When wp_is_large_user_count(), ensure that the post author is always added to author dropdown.

Merges [63060],[63061],[63062],[63063],[63064],[63065],[63067] to the 5.0 branch.

Props xknown, westonruter, jeremyfelt, peterwilsoncc, paulkevan, lucasbustamante, jorbin, desrosj, vortfu, dmsnell, johnbillion, ehtis, batmoo, lancewillett, jonsurrell.

File:

• branches/5.0/src/wp-admin/includes/user.php (modified) (3 diffs)

branches/5.0/src/wp-admin/includes/user.php

@@ -43 +43 @@
                 $user->user_login = sanitize_user($_POST['user_login'], true);
 
+        $errors = new WP_Error();
+
         $pass1 = $pass2 = '';
         if ( isset( $_POST['pass1'] ) )
@@ -63 +65 @@
         }
 
-        if ( isset( $_POST['email'] ))
-                $user->user_email = sanitize_text_field( wp_unslash( $_POST['email'] ) );
+        if ( isset( $_POST['email'] ) ) {
+                $maybe_email = wp_unslash( $_POST['email'] );
+                if ( is_string( $maybe_email ) && is_email( $maybe_email ) ) {
+                        $user->user_email = $maybe_email;
+                } else {
+                        $errors->add( 'invalid_email', __( '<strong>ERROR</strong>: The email address isn&#8217;t correct.' ), array( 'form-field' => 'email' ) );
+                }
+        }
         if ( isset( $_POST['url'] ) ) {
                 if ( empty ( $_POST['url'] ) || $_POST['url'] == 'http://' ) {
@@ -117 +125 @@
         if ( !empty($_POST['use_ssl']) )
                 $user->use_ssl = 1;
-
-        $errors = new WP_Error();
 
         /* checking that username has been typed */