Make WordPress Core

Opened 7 years ago

Closed 7 years ago

Last modified 6 years ago

#43148 closed defect (bug) (fixed)

Email domain whitelist checks should be case-insensitive

Reported by: greatislander's profile greatislander Owned by: jeremyfelt's profile jeremyfelt
Milestone: 5.1 Priority: normal
Severity: normal Version: 4.9.2
Component: Networks and Sites Keywords: has-patch has-unit-tests
Focuses: multisite Cc:

Description

Within wpmu_validate_user_signup(), the user email domain is compared to an array of whitelisted email domains using in_array(). While these lines in is_email_address_unsafe() normalize the user email domain and array of banned email domains by making both lowercase before comparing, this code in wpmu_validate_user_signup() does not normalize case before comparing. This can lead to unexpected behaviour, as in_array() compares strings in a case-sensitive manner.

Given an email domain whitelist as follows…

$limited_email_domains = [ 'wordpress.org' ];

… a user who attempts to register with capital_P_dangit@WordPress.org will receive the following error:

Sorry, that email address is not allowed!

Domain names should be evaluated in a case-insensitive manner in this context.

Attachments (2)

43148.diff (868 bytes) - added by greatislander 7 years ago.
Patch from https://github.com/WordPress/WordPress/pull/337
43148.1.diff (1.8 KB) - added by greatislander 7 years ago.
Add test, add true parameter to in_array()

Download all attachments as: .zip

Change History (12)

#1 @greatislander
7 years ago

  • Summary changed from Email domain whitelists checks should be case-insensitive to Email domain whitelist checks should be case-insensitive

This ticket was mentioned in Slack in #core-multisite by greatislander. View the logs.


7 years ago

@greatislander
7 years ago

Add test, add true parameter to in_array()

This ticket was mentioned in Slack in #core-multisite by greatislander. View the logs.


7 years ago

#4 @greatislander
7 years ago

  • Keywords has-patch has-unit-tests added

This ticket was mentioned in Slack in #core-multisite by greatislander. View the logs.


7 years ago

#6 @mnelson4
7 years ago

These changes seem very straightforward and @greatislander provided good support for why the domains should be compared in a case-insensitive way.

#7 @SergeyBiryukov
7 years ago

  • Milestone changed from Awaiting Review to 5.0

#8 @jeremyfelt
7 years ago

  • Owner set to jeremyfelt
  • Status changed from new to reviewing

#9 @jeremyfelt
7 years ago

  • Resolution set to fixed
  • Status changed from reviewing to closed

In 42858:

Multisite: Use case-insensitive check on email domain whitelist.

Props greatislander.
Fixes #43148.

#10 @flixos90
6 years ago

  • Milestone changed from 5.0 to 5.1
Note: See TracTickets for help on using tickets.