Changeset 12903 for trunk/src/bp-core/classes/class-bp-optout.php

Timestamp:

04/21/2021 07:10:20 PM (5 years ago)

Author:

dcavins

Message:

BP_Optout: Ensure email_address is always lowercase.

When adding, updating, or fetching opt-outs,
be sure that the email address string has
been converted to lowercase, else the comparisons
of the hashed values will fail.

See #8448.

File:

• trunk/src/bp-core/classes/class-bp-optout.php (modified) (4 diffs)

trunk/src/bp-core/classes/class-bp-optout.php

@@ -213 +213 @@
         protected static function _insert( $data = array(), $data_format = array() ) {
                 global $wpdb;
-                // We must hash the email address at insert.
-                $data['email_address_hash'] = wp_hash( $data['email_address_hash'] );
+                // We must lowercase and hash the email address at insert.
+                $email                      = strtolower( $data['email_address_hash'] );
+                $data['email_address_hash'] = wp_hash( $email );
                 return $wpdb->insert( BP_Optout::get_table_name(), $data, $data_format );
         }
@@ -238 +239 @@
                 global $wpdb;
 
-                // Ensure that a passed email address is hashed.
+                // Ensure that a passed email address is lowercased and hashed.
                 if ( ! empty( $data['email_address_hash'] ) && is_email( $data['email_address_hash'] ) ) {
-                        $data['email_address_hash'] = wp_hash( $data['email_address_hash'] );
+                        $email                      = strtolower( $data['email_address_hash'] );
+                        $data['email_address_hash'] = wp_hash( $email );
                 }
 
@@ -297 +299 @@
                         $email_clean = array();
                         foreach ( $emails as $email ) {
+                                $email         = strtolower( $email );
                                 $email_hash    = wp_hash( $email );
                                 $email_clean[] = $wpdb->prepare( '%s', $email_hash );
@@ -331 +334 @@
                 if ( ! empty( $args['search_terms'] ) ) {
                         // Matching email_address is an exact match because of the hashing.
+                        $args['search_terms']             = strtolower( $args['search_terms'] );
                         $search_terms_like                = wp_hash( $args['search_terms'] );
                         $where_conditions['search_terms'] = $wpdb->prepare( '( email_address_hash LIKE %s )', $search_terms_like );