Skip to content

Commit a48a3ce

Browse files
committed
General: Check that user login is stored faithfully by the database.
This checks that if user logins etc. cannot be stored faithfully in the database, the write operation will fail rather than corrupt user data (and potentially lock out users). Props dmsnell.
1 parent 83fc6ff commit a48a3ce

File tree

1 file changed

+28
-0
lines changed

1 file changed

+28
-0
lines changed

tests/phpunit/tests/user.php

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -732,6 +732,34 @@ public function test_user_update_email_error() {
732732
}
733733
}
734734

735+
/**
736+
* Our goal here is to test whether user data can be corrupted
737+
* while being stored in the database. The user data can be almost
738+
* any unicode, while the database might theoretically use e.g.
739+
* ISO-8859-1. ISO-8859-1 can handle a user with login Noël but
740+
* will mishandle a user with login Łukasz.
741+
*
742+
* The database tests provide coverage for this kind of thing
743+
* in general; this test exists to provide additional coverage
744+
* against the risk of locking a user out.
745+
*
746+
* Since the database in the unit test harness uses UTF-8, this test
747+
* needs to set a user login that UTF-8 cannot handle. 0xC0 is that
748+
* (0xC0 never occurs in a valid UTF-8 string). If wpdb refuses to
749+
* store that, we trust that the same logic will also refuse to store
750+
* other impossible strings, such as Łukasz in a database that cannot
751+
* store Ł.
752+
*
753+
* Based on this review comment: https://github.com/WordPress/wordpress-develop/pull/5237#issuecomment-3504963005
754+
*
755+
* @ticket 31992
756+
*/
757+
public function test_user_corrupted_login() {
758+
global $wpdb;
759+
$rows = $wpdb->update( $wpdb->users, array( 'user_login' => hex2bin("c0") ), array( 'ID' => $this->author->ID ) );
760+
$this->assertFalse($rows);
761+
}
762+
735763
/**
736764
* @ticket 27317
737765
* @dataProvider data_illegal_user_logins

0 commit comments

Comments
 (0)