wpmu_validate_blog_signup(): Allow '.' and '-' in blog names

[fo0bar]

Canonical uses Wordpress 3.x multisite as part of voices.canonical.com, for employees who do not have or wish to list their personal blog. The code is stock, except for one patch we maintain, which allows blog names (currently in WP as lowercase alphanumeric only) to also include '.' and '-'. This matches our global username format.

Attached is a patch extending wpmu_validate_blog_signup() to allow '.' and '-', with a tweak for the error text. We have been running the patch for awhile, and have not run across any problems with the rest of the code accepting this.

[fo0bar]

Patch to allow '.' and '-' in blog names, wpmu_validate_blog_signup()

[scribu]

+1

[ocean90]

Related: #15831

[westi]

I think dots are a good addition see #15831 but I'm not sure about "-" because we don't support it in usernames.

I think we should add support for "." and ensure we have the filters available for someone to extend the support for both usernames and hostnames to include - or other chars if they want.

[scribu]

Making the validation filterable is obviously a good idea, but is there any reason usernames can't contain '-'?

[Ipstenu]

Westi, is it okay to have a "." in a blogname for subdomains? That could screw up a host that doesn't permit foo.bar.domain.com (which is why I always thought we didn't permit them in blognames... People can switch between subdomain and subfolder at any time, after all, if they're DB savvy).

[fo0bar]

Replying to Ipstenu:

Westi, is it okay to have a "." in a blogname for subdomains? That could screw up a host that doesn't permit foo.bar.domain.com (which is why I always thought we didn't permit them in blognames... People can switch between subdomain and subfolder at any time, after all, if they're DB savvy).

That was the only issue I could think of when upstreaming this. For our case, any default would be fine, at long as there was the ability to override it at the config level.

[nacin]

I would like to see a filter here, but I'd rather not see the default changed.

[scribu]

Related: #20176

[SergeyBiryukov]

Related: #19724

[ryan]

We have several tickets related to this. We need to comprehensively clean this up. Punting to future release. The wpmu_validate_blog_signup filter can be used by plugins to get around this for now.

[bananastalktome]

Replying to nacin:

I would like to see a filter here, but I'd rather not see the default changed.

+1 to this suggestion. While the defaults may be somewhat restrictive, this may help the casual admin who just wants to set up WordPress and have a guarantee that it will work than the advanced one who is able and willing to do more tweaking to have things work the way they want. Loosening them can be a task left to a filter (though to be fair, there should be a similar filter added for username check as well).

[jeremyfelt]

Moving to 3.7 to discuss possible completion during this cycle.

Theoretically the wpmu_validate_blog_signup filter can be used to further validate based on the work that has already been done previously. The current patch addresses only . and -, but does not add a filter.

[tlovett1]

I don't understand why wpmu_validate_blog_signup() doesn't allow "-" in blogname by default. wp-admin/network/site-new.php runs the domain against the following regex |^{([a-zA-Z0-9-])+$|}

Perhaps blogname is different than domain name? Can anyone clear this up for me.

[Ipstenu]

Is this a dupe of #17397 ?

(Also filter yes, please)

[tlovett1]

It's not a dupe. It was explained to me by Nacin, that on the front users should only be able to create sites with a-Z0-9, whereas in the network admin, super admins should be able to use whatever characters they want.

[SergeyBiryukov]

#25134 was marked as a duplicate.

[jeremyfelt]

Punting this to a future release as we haven't figured out what a filter would look like on the regex for $blogname yet and the current filter, while clunky, will let this happen. Should be able to come around in the near future.

[drewnorthup]

Replying to tlovett1:

I don't understand why wpmu_validate_blog_signup() doesn't allow "-" in blogname by default. wp-admin/network/site-new.php runs the domain against the following regex |^([a-zA-Z0-9-])+$|

Perhaps blogname is different than domain name? Can anyone clear this up for me.

They are only 100% the same in non-network installations. (Of the normal kind anyway, advanced users can do all sorts of crazy things.) In network installations blogname can be related to either a DNS subdomain or a portion of a URI path. In the case of "folder" based network setups there's really no reason not to allow underscores.

In fact, I'd be a bit more bold than just allowing underscores (in folders / URI paths) and suggest that we should provide the option to use full UTF-8 designators (after providing for a warning to the user containing information about IDN and internationalized filesystems).(1) Note, I said the "option" to do so. In other words, make the filter a configurable option (I'd prefer doing so in wp-config.php, as that's potentially faster than putting it in the DB) with a safe default.

(1) Given that just about every "current" filesystem on every "current" OS release supports internationalized character sets the warning needn't be anything particularly dramatic.

[chriscct7]

No movement in almost 2 years. Closing as maybelater. Feel free to reopen when renewed interest (ideally with a patch) emerges.

[jeremyfelt]

We should make a decision on this ticket before closing it. I think allowing - in signup names is plausible, though I haven't given . much thought. I believe the origin of these restrictions is a period in b2++, when the name of the user/blog was used as the database table name - b2_jeremyfelt_posts.

I would definitely welcome some digging, testing, and patching on this ticket.

[jeremyfelt]

#44575 was marked as a duplicate.