![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
#24487 closed defect (bug) (fixed)
is_email() does not recognize IDN domains
| Reported by: | OlegCorner | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | 7.1 |
| Component: | Formatting | Version: | 3.5.1 |
| Severity: | minor | Keywords: | has-patch is-email |
| Cc: | Focuses: |
Description (last modified by )
Insufficient validation of the domain name in function is_email of wp-includes/formatting.php.
WordPress 3.5.1 > , including trunk.
Test for invalid characters does not test Unicode symbols in international domain, such as Cyrillic domains and other Unicode domains.
Attachments (2)
Change History (13)
#1
@
13 years ago
- Description modified (diff)
- Summary Insufficient validation of the domain name in wp-includes/formatting.php → is_email() does not recognize IDN domains
#2
@
12 years ago
- Milestone Awaiting Review → Future Release
Hi OlegCorner. We had quite a bit of "fun" with \P{L}, as it is possible to compile PCRE without Unicode support. See #22692. Not sure what to do here, though it does seem to be possible to check for this support with a separate check, then allow IDN domains through if so. Or, there might be another way to check for this.
#4
@
11 years ago
Can't find how to make a patch here, but i belive we need do add idn_to_ascii function php > 5.4.0
$domain = idn_to_ascii($domain);
on line #2422 in wp-includes/formatting.php
and later
$email = implode( '@', array($local, $domain));
#5
@
10 years ago
It's worth mentioning that WordPress now includes an IDN parser inside Requests: Requests_IDNAEncoder. We could convert IDN domains to their ASCII representation, and if that fails, the domain is invalid. If it succeeds, it can then go through the regular email checks.
This ticket was mentioned in Slack in #core by ocean90. View the logs.
7 years ago
This ticket was mentioned in Slack in #hosting-community by mike. View the logs.
5 years ago
This ticket was mentioned in Slack in #core by tushar_bharti. View the logs.
12 months ago
#10
@
5 weeks ago
- Resolution → fixed
- Status new → closed
This has been resolved with the merge of [62482].
In that patch, IDN domain parts are decoded and then validation is applied to the decoded values. Invalid IDN sequences are rejected. This only works currently when idn_to_utf8() is available, otherwise an email address containing Punycode or ACE-like prefixes will be rejected.
Related: #17491