Upstream/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2024-06-25 22:35:02 +02:00
Code Issues Projects Releases Wiki Activity

REST API: Improve validation for usernames and passwords.

Browse Source 
Also improves the slashing of user data in the REST API to avoid data loss.

Props jnylen0.
Fixes #38739.

Built from https://develop.svn.wordpress.org/trunk@39219


git-svn-id: http://core.svn.wordpress.org/trunk@39159 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Ryan McCue 2016-11-14 07:13:31 +00:00
parent c3f31ce550
commit 65664731e9
2 changed files with 73 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php
View File

@ -417,7 +417,16 @@ class WP_REST_Users_Controller extends WP_REST_Controller {
$ret = wpmu_validate_user_signup( $user->user_login, $user->user_email );
if ( is_wp_error( $ret['errors'] ) && ! empty( $ret['errors']->errors ) ) {
return $ret['errors'];
$error = new WP_Error( 'rest_invalid_param', __( 'Invalid user parameter(s).' ), array( 'status' => 400 ) );
foreach ( $ret['errors']->errors as $code => $messages ) {
foreach ( $messages as $message ) {
$error->add( $code, $message );
}
if ( $error_data = $error->get_error_data( $code ) ) {
$error->add_data( $error_data, $code );
}
}
return $error;
}
}
@ -429,7 +438,7 @@ class WP_REST_Users_Controller extends WP_REST_Controller {
}
$user->ID = $user_id;
$user_id = wp_update_user( $user );
$user_id = wp_update_user( wp_slash( (array) $user ) );
if ( is_wp_error( $user_id ) ) {
return $user_id;
@ -437,7 +446,7 @@ class WP_REST_Users_Controller extends WP_REST_Controller {
add_user_to_blog( get_site()->id, $user_id, '' );
} else {
$user_id = wp_insert_user( $user );
$user_id = wp_insert_user( wp_slash( (array) $user ) );
if ( is_wp_error( $user_id ) ) {
return $user_id;
@ -552,7 +561,7 @@ class WP_REST_Users_Controller extends WP_REST_Controller {
// Ensure we're operating on the same user we already checked.
$user->ID = $id;
$user_id = wp_update_user( $user );
$user_id = wp_update_user( wp_slash( (array) $user ) );
if ( is_wp_error( $user_id ) ) {
return $user_id;
@ -996,6 +1005,61 @@ class WP_REST_Users_Controller extends WP_REST_Controller {
return true;
}
/**
* Check a username for the REST API.
*
* Performs a couple of checks like edit_user() in wp-admin/includes/user.php.
*
* @since 4.7.0
*
* @param mixed $value The username submitted in the request.
* @param WP_REST_Request $request Full details about the request.
* @param string $param The parameter name.
* @return WP_Error|string The sanitized username, if valid, otherwise an error.
*/
public function check_username( $value, $request, $param ) {
$username = (string) rest_sanitize_value_from_schema( $value, $request, $param );
if ( ! validate_username( $username ) ) {
return new WP_Error( 'rest_user_invalid_username', __( 'Username contains invalid characters.' ), array( 'status' => 400 ) );
}
/** This filter is documented in wp-includes/user.php */
$illegal_logins = (array) apply_filters( 'illegal_user_logins', array() );
if ( in_array( strtolower( $username ), array_map( 'strtolower', $illegal_logins ) ) ) {
return new WP_Error( 'rest_user_invalid_username', __( 'Sorry, that username is not allowed.' ), array( 'status' => 400 ) );
}
return $username;
}
/**
* Check a user password for the REST API.
*
* Performs a couple of checks like edit_user() in wp-admin/includes/user.php.
*
* @since 4.7.0
*
* @param mixed $value The password submitted in the request.
* @param WP_REST_Request $request Full details about the request.
* @param string $param The parameter name.
* @return WP_Error|string The sanitized password, if valid, otherwise an error.
*/
public function check_user_password( $value, $request, $param ) {
$password = (string) rest_sanitize_value_from_schema( $value, $request, $param );
if ( empty( $password ) ) {
return new WP_Error( 'rest_user_invalid_password', __( 'Passwords cannot be empty.' ), array( 'status' => 400 ) );
}
if ( false !== strpos( $password, "\\" ) ) {
return new WP_Error( 'rest_user_invalid_password', __( 'Passwords cannot contain the "\\" character.' ), array( 'status' => 400 ) );
}
return $password;
}
/**
* Retrieves the user's schema, conforming to JSON Schema.
*
@ -1022,7 +1086,7 @@ class WP_REST_Users_Controller extends WP_REST_Controller {
'context' => array( 'edit' ),
'required' => true,
'arg_options' => array(
'sanitize_callback' => 'sanitize_user',
'sanitize_callback' => array( $this, 'check_username' ),
),
),
'name' => array(
@ -1066,9 +1130,6 @@ class WP_REST_Users_Controller extends WP_REST_Controller {
'description' => __( 'Description of the resource.' ),
'type' => 'string',
'context' => array( 'embed', 'view', 'edit' ),
'arg_options' => array(
'sanitize_callback' => 'wp_filter_post_kses',
),
),
'link' => array(
'description' => __( 'Author URL to the resource.' ),
@ -1119,6 +1180,9 @@ class WP_REST_Users_Controller extends WP_REST_Controller {
'type' => 'string',
'context' => array(), // Password is never displayed.
'required' => true,
'arg_options' => array(
'sanitize_callback' => array( $this, 'check_user_password' ),
),
),
'capabilities' => array(
'description' => __( 'All capabilities assigned to the resource.' ),

2
wp-includes/version.php
View File

@ -4,7 +4,7 @@
*
* @global string $wp_version
*/
$wp_version = '4.7-beta3-39218';
$wp_version = '4.7-beta3-39219';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.