Ticket #6144: 6144.patch

src/bp-members/bp-members-admin.php

@@ -193 +193 @@
 
                 if ( is_admin() ) {
 
-                        // Filter non multisite user query to remove sign-up users
                         if ( ! is_multisite() ) {
+                                // Filter non multisite user query to remove sign-up users
                                 add_action( 'pre_user_query', array( $this, 'remove_signups_from_user_query' ), 10, 1 );
+
+                                // Make sure user_login validation is consistent with front end
+                                add_action( 'user_profile_update_errors', array( $this, 'validate_new_user' ), 10, 3 );
                         }
 
                         // Reorganise the views navigation in users.php and signups page
@@ -1968 +1971 @@
 
                 <?php
         }
+
+        /**
+         * Validate a user created from the Add new user administration screen
+         *
+         * @since  (2.2.0)
+         *
+         * @param WP_Error $errors the errors that may appear when creating the user from
+     *                         the User Administration Sceen, passed by reference
+         * @param  bool    $update Whether this is a user update
+         * @param  WP_User $user   WP_User object, passed by reference.
+         */
+        public function validate_new_user( &$errors, $update, &$user ) {
+                // Bail if the user is being updated
+                if ( ! empty( $update ) ) {
+                        return;
+                }
+
+                // Make sure registering a user from front end or administration is consistent
+                bp_core_validate_user_signup( $user->user_login, $user->user_email, $errors );
+        }
 }
 endif; // class_exists check
 

src/bp-members/bp-members-functions.php

@@ -1637 +1637 @@
  *
  * @param string $user_name Username to validate.
  * @param string $user_email Email address to validate.
+ * @param WP_Error $errors the errors that may appear when creating the user from
+ *                         the User Administration Sceen, passed by reference
  * @return array Results of user validation including errors, if any.
  */
-function bp_core_validate_user_signup( $user_name, $user_email ) {
+function bp_core_validate_user_signup( $user_name, $user_email, &$errors = null ) {
 
         // Make sure illegal names include BuddyPress slugs and values
         bp_core_flush_illegal_names();
@@ -1650 +1652 @@
                 $result = wpmu_validate_user_signup( $user_name, $user_email );
 
         // When not running Multisite, we perform our own validation. What
-        // follows reproduces much of the logic of wpmu_validate_user_signup(),
-        // minus the multisite-specific restrictions on user_login
+        // follows reproduces much of the logic of wpmu_validate_user_signup()
         } else {
-                $errors = new WP_Error();
+
+                // Define the WP_Error object if not already set
+                if ( ! isset( $errors ) ) {
+                        $errors = new WP_Error();
+                }
 
                 /**
                  * Filters the username before being validated.
@@ -1664 +1669 @@
                  */
                 $user_name = apply_filters( 'pre_user_login', $user_name );
 
+                $orig_username = $user_name;
+                $user_name = preg_replace( '/\s+/', '', sanitize_user( $user_name, true ) );
+
+                if ( $user_name != $orig_username || preg_match( '/[^a-z0-9]/', $user_name ) ) {
+                        $errors->add( 'user_name', __( 'Only lowercase letters (a-z) and numbers are allowed.', 'buddypress' ) );
+                        $user_name = $orig_username;
+                }
+
                 // User name can't be empty
                 if ( empty( $user_name ) ) {
                         $errors->add( 'user_name', __( 'Please enter a username', 'buddypress' ) );
@@ -1782 +1795 @@
                 wpmu_signup_user( $user_login, $user_email, $usermeta );
 
         } else {
-                // Format data
-                $user_login     = preg_replace( '/\s+/', '', sanitize_user( $user_login, true ) );
-                $user_email     = sanitize_email( $user_email );
+                // Generate the activation key for the signup table
                 $activation_key = substr( md5( time() . rand() . $user_email ), 0, 16 );
 
                 /**
@@ -1807 +1818 @@
                                 return $user_id;
                         }
 
+                        // Generate the activation key for the users table
                         $activation_key = wp_hash( $user_id );
                         bp_update_user_meta( $user_id, 'activation_key', $activation_key );
                 }

tests/phpunit/testcases/members/functions.php

@@ -498 +498 @@
 
         }
 
+        /**
+         * @group bp_core_validate_user_signup
+         */
+        public function test_bp_core_validate_user_signup() {
+                if ( is_multisite() ) {
+                        return;
+                }
+
+                // spaces in user_login and a malformed email
+                $s = bp_core_validate_user_signup( 'foo bar', 'foo' );
+                $this->assertNotEmpty( $s['errors']->errors['user_name'] );
+                $this->assertNotEmpty( $s['errors']->errors['user_email'] );
+
+                // empty user_login
+                $s = bp_core_validate_user_signup( '', 'foo@bar.com' );
+                $this->assertNotEmpty( $s['errors']->errors['user_name'] );
+
+                // user_login illegal names
+                $s = bp_core_validate_user_signup( 'root', 'foo@bar.com' );
+                $this->assertNotEmpty( $s['errors']->errors['user_name'] );
+
+                // user_login @
+                $s = bp_core_validate_user_signup( 'foo@bar', 'foo@bar.com' );
+                $this->assertNotEmpty( $s['errors']->errors['user_name'] );
+
+                // user_login < 4
+                $s = bp_core_validate_user_signup( 'foo', 'foo@bar.com' );
+                $this->assertNotEmpty( $s['errors']->errors['user_name'] );
+
+                // user login exists
+                $this->factory->user->create( array( 'user_login' =>'foobar' ) );
+                $s = bp_core_validate_user_signup( 'foobar', 'foo@bar.com' );
+                $this->assertNotEmpty( $s['errors']->errors['user_name'] );
+        }
+
         public function notification_filter_callback( $value ) {
                 $this->filter_fired = current_filter();
                 return $value;