![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 18 years ago
Last modified 4 months ago
#5918 new feature request
Allow non-ASCII usernames
| Reported by: | marshosh | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | Future Release |
| Component: | Charset | Version: | 2.3.3 |
| Severity: | normal | Keywords: | has-patch has-unit-tests |
| Cc: | Focuses: |
Description (last modified by )
WordPress currently transforms usernames and potential usernames into a restricted set of ASCII characters. It attempts to remove HTML, diacritics, and transform other characters to ASCII equivalents, stripping away anything that remains.
This prevents storing usernames that correspond to someone’s name or chosen identify, if that name falls outside the restricted range. For example, the username 北斎 is unusable because sanitize_user( '北斎', true ) returns the empty string.
WordPress should relax its restrictions on usernames to be more inclusive and permit locale-specific sites and users to express themselves as they are, not having to make concessions for latin-based technology.
Complications
- Not all restrictions should be removed, but it would be important to double-down on the original intent of those filters; notably, to limit confusable characters such as non-printable and non-visible characters. Unicode defines considerably more complicated text rules, so an update to the system should improve the Unicode compliance surrounding these issues.
- Given the higher probability of multiple representations for non-ASCII usernames, it would be important to normalize all inputs using an appriate algorithm, such as NKFD.
- Existing code and plugins are going to assume ASCII-only usernames and unlocking more complete naming should not introduce any more backwards compatibility breaks than are absolutely necessary.
- Some installations will be running on non-UTF-8 database tables which cannot represent all possible Unicode-based usernames. For these installations, it must be clear that extended username support is unavailable.
- Any changes to URL routing need to maintain redirects to the legacy ASCII-based structure to prevent breaking existing integrations which assume the fixed patterns; for example,
/author/dmsnellshould redirect to/autor/dmsnellon a German site…
Help
Unicode provides ample guidance here which can help WordPress to:
- avoid known security issues
- implement these behaviors in harmony with expectations from other software
- how to best display these characters in interfaces
Warnings
- Unicode Security FAQ and Security Considerations Technical Report
- Spotify shared about some security issues with Unicode usernames.
Related
- #62948 Non-ASCII slugs need comprehensive transformation and inspection as well.
Attachments (6)
Change History (44)
#4
@
17 years ago
- Cc added
Here is a patch that will enable a user to register with an arabic name.
(however, it also probably introduces security issues)
#6
@
17 years ago
- Milestone 2.9 → 3.0
Something to consider for 3.0 after considering all security ramifications.
#7
@
16 years ago
- Keywords early added
- Milestone 3.0 → 3.1
Moving to 3.1, As ryan said, We need to consider any of the security ramifications of this change. We're nearing beta right now, it doesn't seem appropriate to change this late in the game.
#9
@
15 years ago
- Cc added
- Summary Registr with Arabic (Non-English) characters ? → Allow non-ASCII usernames
- Version 2.3.3 → 3.1
Please consider implementing this in 3.2. Registration always confuses my users because they cannot use non-ASCII characters.
#10
@
15 years ago
- Version 3.1 → 2.3.3
Please leave the version field set to when it was originally reported.
#11
@
15 years ago
Sorry, I was just trying to say that the same issue still exists in the latest version.
#12
@
15 years ago
- Version 2.3.3 → 3.3
I think this is really a must-have feature for WordPress, from my experience, trying to create Arabic website with WordPress, it made a lot of confusion to users cause they simply tried to make Arabic names and every time it tell them the name is wrong and never mentioned anything about language, not even a warning or a comment to say the name should be in English, so it took me a while and losing a lot of users too before I figured out that WordPress doesn't support Arabic names at all.
It's really needed fix for WordPress localization, there is no point of creating Arabic website if your users can't choose their name in Arabic :) I hope this is being considered for 3.3
#13
follow-up:
↓ 14
@
15 years ago
- Version 3.3 → 2.3.3
Version changed from 2.3.3 to 3.3
The version field is used to track when a issue was first raised, This need not be updated to a current release upon commenting. Any version between the "Version" and "Milestone" field is considered to be affected
#14
in reply to: ↑ 13
@
15 years ago
Replying to dd32:
Version changed from 2.3.3 to 3.3
The version field is used to track when a issue was first raised, This need not be updated to a current release upon commenting. Any version between the "Version" and "Milestone" field is considered to be affected
Okay, didn't mean to mess with anything, I just thought it's the right way to promote the ticket to the version. well, any comments about the ticket subject itself?
#16
@
14 years ago
Username values related: #17793, #16833
Also, this does not appear to actually be a bug, more of a feature request / enhancement.
WP might not have been clear in the past, and may have allowed more, but there is a specific set of valid characters for usernames, and it doesn't even include the full ASCII range now. See #17793 for a patch currently open to make valid characters more clear in user creation error messages.
I think it's safe to say at this point that the username values will never support any characters outside of it's current range of characters.
#18
@
14 years ago
- Cc added
- Keywords needs-refresh added
- Version 2.3.3
As the WordPress is a global script , non-ascii user names should be supported in the core , This ticket was opening before 5 years !
#23
follow-up:
↓ 24
@
14 years ago
- Version 3.5 → 2.3.3
Version number indicates when the enhancement was initially suggested. See comment:13.
#24
in reply to: ↑ 23
@
14 years ago
Replying to SergeyBiryukov:
Version number indicates when the enhancement was initially suggested. See comment:13.
:) , Thank you for explaining .
This ticket was mentioned in IRC in #wordpress-dev by SergeyBiryukov. View the logs.
12 years ago
#33
@
12 months ago
Enhancement: Allow non-ASCII usernames by updating sanitize_user() to support Unicode letters.
#35
@
4 months ago
- Component Users → Charset
- Description modified (diff)
- Type enhancement → feature request
#36
@
4 months ago
@marshosh I hope it’s okay, but I expanded the Ticket’s description to try and convey more of the scale of the issue. Thanks for bringing this up.
This ticket was mentioned in PR #11133 on WordPress/wordpress-develop by @dmsnell.
4 months ago
#37
- Keywords has-unit-tests added; needs-refresh removed
Trac ticket: Core-5918
## Status
WIP
Props dmsnell, tusharbharti, SirLouen, Mukesh Panchal.
related: #9591