#43148 closed defect (bug) (fixed)
Email domain whitelist checks should be case-insensitive
Reported by: |
|
Owned by: |
|
---|---|---|---|
Milestone: | 5.1 | Priority: | normal |
Severity: | normal | Version: | 4.9.2 |
Component: | Networks and Sites | Keywords: | has-patch has-unit-tests |
Focuses: | multisite | Cc: |
Description
Within wpmu_validate_user_signup()
, the user email domain is compared to an array of whitelisted email domains using in_array()
. While these lines in is_email_address_unsafe()
normalize the user email domain and array of banned email domains by making both lowercase before comparing, this code in wpmu_validate_user_signup()
does not normalize case before comparing. This can lead to unexpected behaviour, as in_array()
compares strings in a case-sensitive manner.
Given an email domain whitelist as follows…
$limited_email_domains = [ 'wordpress.org' ];
… a user who attempts to register with capital_P_dangit@WordPress.org
will receive the following error:
Sorry, that email address is not allowed!
Domain names should be evaluated in a case-insensitive manner in this context.
Attachments (2)
Change History (12)
#1
@
7 years ago
- Summary changed from Email domain whitelists checks should be case-insensitive to Email domain whitelist checks should be case-insensitive
Patch from https://github.com/WordPress/WordPress/pull/337