[wp-trac] [WordPress Trac] #33800: wp_delete_user delete the user ID 1 if an object is passed in param

WordPress Trac noreply at wordpress.org
Wed Sep 9 23:55:56 UTC 2015


#33800: wp_delete_user delete the user ID 1 if an object is passed in param
--------------------------+-----------------------------
 Reporter:  juliobox      |      Owner:
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Users         |    Version:  2.0
 Severity:  normal        |   Keywords:
  Focuses:                |
--------------------------+-----------------------------
 Hello, consider this, using a fresh installation:

 {{{
 $user_id = wp_insert_user( $args ); // with email already in use
 wp_delete_user( $user_id );
 }}}

 Because of the email issue, $user_id is not an actual ID (ie. integer) but
 an object, a WP_Error one.

 So if you pass an object into wp_delete_user, it will do this:
 {{{
 $id = (int) $id;
 $user = new WP_User( $id );
 }}}
 Now, your object is equal to "1", and "1" is the 1st user, the admin.
 Since WordPress allow the site to have 0 users (what?) and delete the last
 admin (WHAAAAT??), this is kind of annoying.

 So, i know, the developper has to check if the $user_id is not a WP_Error,
 but this is still strange to cast INT.

 '''I would recommand to not cast integer''', but check if is_numeric or is
 already a WP_User.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/33800>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform


More information about the wp-trac mailing list