User registration on multisite: don't allow usernames to be >60 characters long.

[DJPaul]

In wpmu_validate_user_signup() at the "has someone already signed up for this username?" check, it doesn't work as expected in situations where $wpdb->signups has truncated a new record's user_login value down to its maximum column size (which is 60 characters). The check will never match any records where the new username is >60 characters.

To recreate on multisite:

1. Register a new user account with a 60-character long username via wp-login.php?action=register.
2. Activate the account via link provided in email, and log in.
3. Everything should work as expected. Log out.
4. Register another new user account; use a different email address. Use the same username as previously, but add at least 1 extra character to the end of it.
5. It will accept this username, though you'll be unable to activate the account. It will say that it's already been activated; look at the record in the wp_signups table and see that user_login has been truncated to the first 60 characters of the string you provided.

The attached patch adds a new validation check to wpmu_validate_user_signup() which rejects the username if it's >60 characters.

[nacin]

Given user_login varchar(60) NOT NULL default '',, seems good to me.

[boonebgorges]

In 31970:

Unit tests for wpmu_validate_user_signup().

See #17904, #26784.

[pento]

In 31978:

Unit Tests added in [31970] need to be restricted to run in Multisite only.

See #17904, #26784.

[wonderboymusic]

Can this be consolidated with #17904?

[jeremyfelt]

Replying to wonderboymusic:

Can this be consolidated with #17904?

I think we can get this one in now as the change is very small and tests are in place. After re-reading #17904, I think it's a lot closer than I remembered. We can continue work there for the next cycle.

[jeremyfelt]

In 33083:

Usernames in multisite should be restricted to 60 characters or fewer.

Only 60 characters can be stored in the database for a username, which could cause lookup issues when attempting to use similar usernames of extreme length.

Props @DJPaul.
See #17904, Fixes #26784.