[wp-trac] [WordPress Trac] #38739: REST API: slashing and validation: users

[WordPress Trac]

#38739: REST API: slashing and validation: users
--------------------------+--------------------------------------
 Reporter:  jnylen0       |      Owner:
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  4.7
Component:  REST API      |    Version:  trunk
 Severity:  major         |   Keywords:  has-patch has-unit-tests
  Focuses:                |
--------------------------+--------------------------------------
 There are multiple issues with validation of user parameters in the API:

 - Improper/missing validation of usernames as compared to wp-admin.  This
 allows creating a user with e.g. `username=¯\_(ツ)_/¯` (in this case, the
 username is sanitized to `__` internally).
 - The API skips the `illegal_user_logins` filter that sites can use to
 customize a list of prohibited usernames.
 - Missing checks for password: cannot be empty, cannot contain `\`.
 - Backslashes are eaten (see also #38609, #38704, #38726).

 This patch fixes the above issues and adds tests.  The validation checks
 are adapted from `edit_user`
 [https://core.trac.wordpress.org/browser/trunk/src/wp-
 admin/includes/user.php?rev=39187&marks=140,145,157,164-166#L128 here].

 In order to test updating user passwords, we need to mock out
 `wp_clear_auth_cookie` and `wp_set_auth_cookie`.  Otherwise, this error
 occurs due to the `setcookie` calls in those functions:

  Cannot modify header information - headers already sent by (output
 started at tests/phpunit/includes/bootstrap.php:61)

 HTML tags and other nastiness are currently removed from usernames
 correctly because `wp_insert_user` calls `sanitize_user( $username, true
 )`.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/38739>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform