wp_insert_user() wiping out user_pass when one isn't provided and the user exists

[cartpauj]

This is similar to #21495 but not identical.

Passing wp_insert_user() the following for example, will cause the Users password to be nullified if the user already exists:

array(6) {

  ["role"]=>

  string(10) "subscriber"

  ["user_login"]=>

  string(15) "test"

  ["user_email"]=>

  string(15) "test@example.com"

  ["first_name"]=>

  string(3) "John"

  ["last_name"]=>

  string(3) "Doe"

  ["ID"]=>

  int(123)

}

I propose changing (found here: ​http://cspf.co/XvqW)

$user_pass = $userdata['user_pass'];

to this or something similar

$user_pass = (isset($userdata['user_pass']) && !empty($userdata['user_pass']))?$userdata['user_pass']:$old_user_data->user_pass;

[leewillis77]

Attached is a patch, with tests, that implements this behaviour.

[SergeyBiryukov]

Related: #25745

[leewillis77]

Hi Sergey,

Thanks for your comment - in that case perhaps deprecating the use case of passing a user ID is the better solution here. Patch attached.

[SergeyBiryukov]

Looks like this was a regression in [28454], so 29880.diff​ might be the way to go.

[wonderboymusic]

In 35618:

Users: in wp_insert_user(), when a password isn't provided and the user exists, ensure that the password isn't wiped out.

Adds unit test.

Props leewillis77.
Fixes #29880.

[SergeyBiryukov]

In 35732:

Users: Move the tests added in [35116] and [35618] to a more appropriate place and give them a better name.

See #28435, #29880.