#43148 closed defect (bug) (fixed)
Email domain whitelist checks should be case-insensitive
| Reported by: |
|
Owned by: |
|
|---|---|---|---|
| Milestone: | 5.1 | Priority: | normal |
| Severity: | normal | Version: | 4.9.2 |
| Component: | Networks and Sites | Keywords: | has-patch has-unit-tests |
| Focuses: | multisite | Cc: |
Description
Within wpmu_validate_user_signup(), the user email domain is compared to an array of whitelisted email domains using in_array(). While these lines in is_email_address_unsafe() normalize the user email domain and array of banned email domains by making both lowercase before comparing, this code in wpmu_validate_user_signup() does not normalize case before comparing. This can lead to unexpected behaviour, as in_array() compares strings in a case-sensitive manner.
Given an email domain whitelist as follows…
$limited_email_domains = [ 'wordpress.org' ];
… a user who attempts to register with capital_P_dangit@WordPress.org will receive the following error:
Sorry, that email address is not allowed!
Domain names should be evaluated in a case-insensitive manner in this context.
Attachments (2)
Change History (12)
#1
@
8 years ago
- Summary changed from Email domain whitelists checks should be case-insensitive to Email domain whitelist checks should be case-insensitive
Patch from https://github.com/WordPress/WordPress/pull/337