Skip to content

Commit f9d9982

Browse files
committed
General: Check that user login is stored faithfully by the database.
This checks that if user logins etc. cannot be stored faithfully in the database, the write operation will fail rather than corrupt user data (and potentially lock out users). Props dmsnell.
1 parent dd700d7 commit f9d9982

File tree

1 file changed

+28
-0
lines changed

1 file changed

+28
-0
lines changed

tests/phpunit/tests/user.php

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -958,6 +958,34 @@ public function test_user_update_email_error() {
958958
}
959959
}
960960

961+
/**
962+
* Our goal here is to test whether user data can be corrupted
963+
* while being stored in the database. The user data can be almost
964+
* any unicode, while the database might theoretically use e.g.
965+
* ISO-8859-1. ISO-8859-1 can handle a user with login Noël but
966+
* will mishandle a user with login Łukasz.
967+
*
968+
* The database tests provide coverage for this kind of thing
969+
* in general; this test exists to provide additional coverage
970+
* against the risk of locking a user out.
971+
*
972+
* Since the database in the unit test harness uses UTF-8, this test
973+
* needs to set a user login that UTF-8 cannot handle. 0xC0 is that
974+
* (0xC0 never occurs in a valid UTF-8 string). If wpdb refuses to
975+
* store that, we trust that the same logic will also refuse to store
976+
* other impossible strings, such as Łukasz in a database that cannot
977+
* store Ł.
978+
*
979+
* Based on this review comment: https://github.com/WordPress/wordpress-develop/pull/5237#issuecomment-3504963005
980+
*
981+
* @ticket 31992
982+
*/
983+
public function test_user_corrupted_login() {
984+
global $wpdb;
985+
$rows = $wpdb->update( $wpdb->users, array( 'user_login' => hex2bin( 'c0' ) ), array( 'ID' => $this->author->ID ) );
986+
$this->assertFalse( $rows );
987+
}
988+
961989
/**
962990
* @ticket 27317
963991
* @dataProvider data_illegal_user_logins

0 commit comments

Comments
 (0)