search field (users) looses AT sign in field after editting profile

[PcTevree]

We noticed that at the search field (users) if you search for a email-address, it looses the AT (@) sign in searchfield after editting profile and clicking the "to to users" button, the mailaddress IS filled in, but the @ sign is gone.

1 minute explainer video: ​https://youtu.be/xD5P_LkGH4s

Hope you can make this better.

[knutsp]

Hello @PcTevree and welcome to Trac!

I just tested by searching for a user with en email adddress, edited, saved and went back to the search results using the backlink.

Ths full email address, including the @, still appeared in the search field.

Only difference was that I did not test with Storefront, but with several other classic themes, plus with the Twenty Twenty-Five theme. Did you try other themes?

[PcTevree]

Hi @knutsp

Plse check ​https://youtu.be/wSo4w_9Utw8 <-- new video

Its only wordpress installed, if you want i can skip you a login of this test area (can i post that secure here?)

... BUT i get this at all my wp-websites online, regardlessly also of what host.

[siliconforks]

Replying to knutsp:

I just tested by searching for a user with en email adddress, edited, saved and went back to the search results using the backlink.

Ths full email address, including the @, still appeared in the search field.

That's odd, I tested it and was able to reproduce the issue easily (using the latest trunk version of WordPress).

Are you running an older version of WordPress? I suspect this issue may have been introduced a few months ago (in r58069).

See ​this line which will strip out any %-encoded characters, including the @ symbol (encoded as %40).

$wp_http_referer = ! empty( $_REQUEST['wp_http_referer'] ) ? sanitize_text_field( $_REQUEST['wp_http_referer'] ) : '';

Trac ticket: https://core.trac.wordpress.org/ticket/62551

[yogeshbhutkar]

Hi @PcTevree,

Welcome to Trac and Thanks for reporting the issue. I was able to reproduce the issue at my end and have submitted a potential solution for the bug.

Also, thanks to @siliconforks for analyzing the bug, and yes, the issue was caused by sanitize_text_field itself as it was stripping out all the %-encoded characters, replacing it with sanitize_url made more sense (as wp_http_referrer is not a generic text field) and fixed the issue.

[stromhalm]

#62659 was marked as a duplicate.

[shanemuir]

62551 - Test without patch

[shanemuir]

65221 - With patch applied

[shanemuir]

Test Report

Description

This report validates whether the indicated patch works as expected.

Patch tested: ​https://patch-diff.githubusercontent.com/raw/WordPress/wordpress-develop/pull/7883.diff

Environment

• WordPress: 6.8-alpha-59274-src
• PHP: 8.2.26
• Server: Apache/2.4.62 (Unix) OpenSSL/3.4.0 PHP/8.2.26
• Database: mysqli (Server: 8.0.39 / Client: mysqlnd 8.2.26)
• Browser: Chrome 131.0.0.0
• OS: macOS
• Theme: Twenty Twenty-Five 1.0
• MU Plugins: None activated
• Plugins:
  • Test Reports 1.2.0

Actual Results

1. ✅ Issue resolved with patch.

Supplemental Artifacts

Reproduced issue without patch:- https://core.trac.wordpress.org/attachment/ticket/62551/%2362551-without-patch.mov

Issue resolved with patch applied:- https://core.trac.wordpress.org/attachment/ticket/62551/%2365221-with-patch.mov

[SergeyBiryukov]

In 59496:

Coding Standards: Use correct escaping function for wp_http_referer.

Follow-up to [58069].

Props yogeshbhutkar, sainathpoojary, PcTevree, knutsp, siliconforks, stromhalm, shanemuir.
Fixes #62551.

Thanks for the PR! Merged in r59496.