From 65664731e97a3f93686174d31fa4cbed05abbf67 Mon Sep 17 00:00:00 2001 From: Ryan McCue Date: Mon, 14 Nov 2016 07:13:31 +0000 Subject: [PATCH] REST API: Improve validation for usernames and passwords. Also improves the slashing of user data in the REST API to avoid data loss. Props jnylen0. Fixes #38739. Built from https://develop.svn.wordpress.org/trunk@39219 git-svn-id: http://core.svn.wordpress.org/trunk@39159 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- .../class-wp-rest-users-controller.php | 80 +++++++++++++++++-- wp-includes/version.php | 2 +- 2 files changed, 73 insertions(+), 9 deletions(-) diff --git a/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php b/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php index 949a66863d..4a693ba571 100644 --- a/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php +++ b/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php @@ -417,7 +417,16 @@ class WP_REST_Users_Controller extends WP_REST_Controller { $ret = wpmu_validate_user_signup( $user->user_login, $user->user_email ); if ( is_wp_error( $ret['errors'] ) && ! empty( $ret['errors']->errors ) ) { - return $ret['errors']; + $error = new WP_Error( 'rest_invalid_param', __( 'Invalid user parameter(s).' ), array( 'status' => 400 ) ); + foreach ( $ret['errors']->errors as $code => $messages ) { + foreach ( $messages as $message ) { + $error->add( $code, $message ); + } + if ( $error_data = $error->get_error_data( $code ) ) { + $error->add_data( $error_data, $code ); + } + } + return $error; } } @@ -429,7 +438,7 @@ class WP_REST_Users_Controller extends WP_REST_Controller { } $user->ID = $user_id; - $user_id = wp_update_user( $user ); + $user_id = wp_update_user( wp_slash( (array) $user ) ); if ( is_wp_error( $user_id ) ) { return $user_id; @@ -437,7 +446,7 @@ class WP_REST_Users_Controller extends WP_REST_Controller { add_user_to_blog( get_site()->id, $user_id, '' ); } else { - $user_id = wp_insert_user( $user ); + $user_id = wp_insert_user( wp_slash( (array) $user ) ); if ( is_wp_error( $user_id ) ) { return $user_id; @@ -552,7 +561,7 @@ class WP_REST_Users_Controller extends WP_REST_Controller { // Ensure we're operating on the same user we already checked. $user->ID = $id; - $user_id = wp_update_user( $user ); + $user_id = wp_update_user( wp_slash( (array) $user ) ); if ( is_wp_error( $user_id ) ) { return $user_id; @@ -996,6 +1005,61 @@ class WP_REST_Users_Controller extends WP_REST_Controller { return true; } + /** + * Check a username for the REST API. + * + * Performs a couple of checks like edit_user() in wp-admin/includes/user.php. + * + * @since 4.7.0 + * + * @param mixed $value The username submitted in the request. + * @param WP_REST_Request $request Full details about the request. + * @param string $param The parameter name. + * @return WP_Error|string The sanitized username, if valid, otherwise an error. + */ + public function check_username( $value, $request, $param ) { + $username = (string) rest_sanitize_value_from_schema( $value, $request, $param ); + + if ( ! validate_username( $username ) ) { + return new WP_Error( 'rest_user_invalid_username', __( 'Username contains invalid characters.' ), array( 'status' => 400 ) ); + } + + /** This filter is documented in wp-includes/user.php */ + $illegal_logins = (array) apply_filters( 'illegal_user_logins', array() ); + + if ( in_array( strtolower( $username ), array_map( 'strtolower', $illegal_logins ) ) ) { + return new WP_Error( 'rest_user_invalid_username', __( 'Sorry, that username is not allowed.' ), array( 'status' => 400 ) ); + } + + return $username; + } + + /** + * Check a user password for the REST API. + * + * Performs a couple of checks like edit_user() in wp-admin/includes/user.php. + * + * @since 4.7.0 + * + * @param mixed $value The password submitted in the request. + * @param WP_REST_Request $request Full details about the request. + * @param string $param The parameter name. + * @return WP_Error|string The sanitized password, if valid, otherwise an error. + */ + public function check_user_password( $value, $request, $param ) { + $password = (string) rest_sanitize_value_from_schema( $value, $request, $param ); + + if ( empty( $password ) ) { + return new WP_Error( 'rest_user_invalid_password', __( 'Passwords cannot be empty.' ), array( 'status' => 400 ) ); + } + + if ( false !== strpos( $password, "\\" ) ) { + return new WP_Error( 'rest_user_invalid_password', __( 'Passwords cannot contain the "\\" character.' ), array( 'status' => 400 ) ); + } + + return $password; + } + /** * Retrieves the user's schema, conforming to JSON Schema. * @@ -1022,7 +1086,7 @@ class WP_REST_Users_Controller extends WP_REST_Controller { 'context' => array( 'edit' ), 'required' => true, 'arg_options' => array( - 'sanitize_callback' => 'sanitize_user', + 'sanitize_callback' => array( $this, 'check_username' ), ), ), 'name' => array( @@ -1066,9 +1130,6 @@ class WP_REST_Users_Controller extends WP_REST_Controller { 'description' => __( 'Description of the resource.' ), 'type' => 'string', 'context' => array( 'embed', 'view', 'edit' ), - 'arg_options' => array( - 'sanitize_callback' => 'wp_filter_post_kses', - ), ), 'link' => array( 'description' => __( 'Author URL to the resource.' ), @@ -1119,6 +1180,9 @@ class WP_REST_Users_Controller extends WP_REST_Controller { 'type' => 'string', 'context' => array(), // Password is never displayed. 'required' => true, + 'arg_options' => array( + 'sanitize_callback' => array( $this, 'check_user_password' ), + ), ), 'capabilities' => array( 'description' => __( 'All capabilities assigned to the resource.' ), diff --git a/wp-includes/version.php b/wp-includes/version.php index 60caa3438b..8087608771 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -4,7 +4,7 @@ * * @global string $wp_version */ -$wp_version = '4.7-beta3-39218'; +$wp_version = '4.7-beta3-39219'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.