Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a filter on wp_insert_user function regarding $user_pass (ticket #49639) #7384

Open
wants to merge 8 commits into
base: trunk
Choose a base branch
from
+48 −3
Open

Add a filter on wp_insert_user function regarding $user_pass (ticket #49639) #7384

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
733682b
commiting track version
mklute101 Sep 17, 2024
8478f17
Replace usage of `strpos()` with `str_contains()`.
mklute101 Sep 17, 2024
549954b
removed use of wp_unslash as WordPress hasn't done any escaping to th…
mklute101 Sep 17, 2024
2d89001
update @ since tag to 6.7.0
mklute101 Sep 17, 2024
2a4dc77
test for empty pass and slash
mklute101 Sep 17, 2024
7c597dc
remove check for slash, as it seems to be allowed and caused this tes…
mklute101 Sep 17, 2024
7c00162
ran PHPCS
mklute101 Sep 17, 2024
4b0891e
remove the test for backslash
mklute101 Sep 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 29 additions & 3 deletions src/wp-includes/user.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2136,8 +2136,22 @@ function wp_insert_user( $userdata ) {
$user_pass = ! empty( $userdata['user_pass'] ) ? $userdata['user_pass'] : $old_user_data->user_pass;
} else {
$update = false;

/**
* Filters a password before hashing it.
*
* @since 6.7.0
*
* @param string $userdata['user_pass'] The user's password.
*/
$pre_hash_password = apply_filters( 'pre_hash_password', $userdata['user_pass'] );

if ( empty( $pre_hash_password ) ) {
return new WP_Error( 'empty_pre_hash_password', __( 'Cannot create a user with an empty password.' ) );
}

// Hash the password.
$user_pass = wp_hash_password( $userdata['user_pass'] );
$user_pass = wp_hash_password( $pre_hash_password );
}

$sanitized_user_login = sanitize_user( $userdata['user_login'], true );
Expand Down Expand Up @@ -2591,9 +2605,21 @@ function wp_update_user( $userdata ) {
$user = add_magic_quotes( $user );

if ( ! empty( $userdata['user_pass'] ) && $userdata['user_pass'] !== $user_obj->user_pass ) {

/** This filter is documented in wp-includes/user.php */
$pre_hash_password = apply_filters( 'pre_hash_password', $userdata['user_pass'] );

if ( empty( $pre_hash_password ) ) {
return new WP_Error( 'empty_pre_hash_password', __( 'Empty password.' ) );
}

if ( false !== strpos( $pre_hash_password, '\\' ) ) {
return new WP_Error( 'illegal_pre_hash_password', __( 'Passwords may not contain the character "\\".' ) );
}
Comment on lines +2616 to +2618
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we want the update and insert to match, so we should remove this block here as well.


// If password is changing, hash it now.
$plaintext_pass = $userdata['user_pass'];
$userdata['user_pass'] = wp_hash_password( $userdata['user_pass'] );
$plaintext_pass = $pre_hash_password;
$userdata['user_pass'] = wp_hash_password( $pre_hash_password );

/**
* Filters whether to send the password change email.
Expand Down
19 changes: 19 additions & 0 deletions tests/phpunit/tests/user.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2185,4 +2185,23 @@ public function export_additional_user_profile_data_with_dup_name() {

return $additional_profile_data;
}

/**
* Test that an error is returned when the password is empty.
*
* @ticket 49639
*/
public function test_wp_insert_user_empty_password() {
$user_data = array(
'user_login' => 'test_user_empty',
'user_email' => '[email protected]',
'user_pass' => '', // Empty password
);

$create_user = wp_insert_user( $user_data );

$this->assertWPError( $create_user );
$this->assertSame( 'empty_pre_hash_password', $create_user->get_error_code() );
$this->assertSame( 'Cannot create a user with an empty password.', $create_user->get_error_message() );
}
}
Loading