Changeset 14602

Timestamp:

11/12/2025 04:43:43 AM (19 hours ago)

Author:

dd32

Message:

Registration: Store a sanitised version of the email (no plus addressing) to ease searches for accounts by email address.

Location:

sites/trunk

Files:

• api.wordpress.org/public_html/dotorg/helpscout/profile.php (modified) (4 diffs)
• wordpress.org/public_html/wp-content/themes/pub/wporg-login/admin/class-user-registrations-list-table.php (modified) (2 diffs)
• wordpress.org/public_html/wp-content/themes/pub/wporg-login/functions-registration.php (modified) (3 diffs)
• wordpress.org/public_html/wp-content/themes/pub/wporg-login/functions-restapi.php (modified) (1 diff)

sites/trunk/api.wordpress.org/public_html/dotorg/helpscout/profile.php

@@ -6 +6 @@
 include __DIR__ . '/common.php';
 
+// Include the registration functions.. wporg_sanitize_email_for_search().
+include_once WP_CONTENT_DIR . '/themes/pub/wporg-login/functions-registration.php';
+
 // $request is the validated HelpScout request.
 $request = get_request();
@@ -12 +15 @@
 $html = '';
 $user = false;
+
 $email = get_user_email_for_email( $request );
 
@@ -38 +42 @@
     }
 
-    $gmail_dotless = $request->customer->email;
-    if ( str_ends_with( strtolower( $gmail_dotless ), '@gmail.com' ) ) {
-        $gmail_dotless = str_replace( '.', '', strstr( $gmail_dotless, '@', true ) ) . '@gmail.com';
-    }
-
     // See if they have a pending user account.
     $records = $wpdb->get_results( $wpdb->prepare(
-        "SELECT * FROM {$wpdb->base_prefix}user_pending_registrations
-        WHERE user_email = %s OR user_email = %s OR user_email LIKE %s",
+        "SELECT * FROM %i
+        WHERE ( user_email = %s OR user_email_san = %s OR user_email = %s OR user_email_san = %s )",
+        "{$wpdb->base_prefix}user_pending_registrations",
         $request->customer->email,
-        $gmail_dotless,
-        str_replace( '@', '+%@', $wpdb->esc_like( $request->customer->email ) ) // Handle plus addressing.
+        wporg_sanitize_email_for_search( $request->customer->email ),
+        $email,
+        wporg_sanitize_email_for_search( $email )
     ) );
     if ( $records ) {
@@ -117 +118 @@
 
 // response to HS is just HTML to display in the sidebar
+header( 'Content-Type: application/json; charset=utf-8' );
 echo json_encode( array( 'html' => $html ) );

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/admin/class-user-registrations-list-table.php

@@ -181 +181 @@
             $search_term = wp_unslash( $_GET['s'] );
             $search_like = '%' . $wpdb->esc_like( $search_term ) . '%';
-
+            
             // Limit searches to where they're likely, for performance.
             if ( str_contains( $search_term, '@' ) ) {
+                $san_search_term = wporg_sanitize_email_for_search( $search_term );
+                $san_search_like = '%' . $wpdb->esc_like( $san_search_term ) . '%';
+
                 // If it looks like a full email, exact match.
                 if ( preg_match( '/^.{3,}@.+[.].+$/', $search_term ) ) {
                     // Looks like an email, so just search the emails.
                     $where .= $wpdb->prepare(
-                        "AND registrations.user_email = %s",
-                        $search_term
+                        "AND ( registrations.user_email = %s OR registrations.user_email_san = %s )",
+                        $search_term,
+                        $san_search_term
                     );
                 } else {
                     // Otherwise, a wildcard on the email.
                     $where .= $wpdb->prepare(
-                        "AND registrations.user_email LIKE %s",
-                        $search_like
+                        "AND ( registrations.user_email LIKE %s OR registrations.user_email_san LIKE %s )",
+                        $search_like,
+                        $san_search_like
                     );
                 }
@@ -216 +221 @@
                         registrations.user_login LIKE %s OR
                         registrations.user_email LIKE %s OR
+                        registrations.user_email_san LIKE %s OR
                         registrations.meta LIKE %s OR
                         description.meta_value LIKE %s
                     )",
-                    $search_like, $search_like, $search_like, $search_like
+                    $search_like, $search_like, $search_like, $search_like, $search_like
                 );
             }

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/functions-registration.php

@@ -260 +260 @@
     ), ARRAY_A );
 
+    // Try again on the sanitized field..
+    if ( ! $pending_user && 'user_email' === $field ) {
+        $who          = wporg_sanitize_email_for_search( $who );
+        $pending_user = $wpdb->get_row( $wpdb->prepare(
+            'SELECT * FROM %i WHERE user_email_san = %s LIMIT 1',
+            "{$wpdb->base_prefix}user_pending_registrations",
+            $who
+        ), ARRAY_A );
+    }
+
     if ( ! $pending_user ) {
         return false;
@@ -276 +286 @@
 
 /**
- * Fetches a pending user record from the database by "inbox", ignoring plus addressing.
- */
-function wporg_get_pending_user_by_email_wildcard( $email ) {
-    global $wpdb;
-
-    $email_wildcard = preg_replace( '/[+][^@]+@/i', '+%@', $wpdb->esc_like( $email ) );  // abc+def@ghi => abc+%@ghi
-    $email_base     = preg_replace( '/[+][^@]+@/i', '@', $email ); // abc+def@ghi => abc@ghi
-
-    $matching_email = $wpdb->get_var( $sql = $wpdb->prepare(
-        'SELECT `user_email` FROM %i WHERE ( `user_email` = %s OR `user_email` LIKE %s ) LIMIT 1',
-        "{$wpdb->base_prefix}user_pending_registrations",
-        $email_base,
-        $email_wildcard
-    ) );
-
-    if ( $matching_email ) {
-        return wporg_get_pending_user( $matching_email );
-    }
-
-    // If gmail, check to see if there's a match ignoring dots and plus addressing.
-    if ( str_ends_with( strtolower( $email ), '@gmail.com' ) && substr_count( $email, '.' ) > 1 ) {
-        $gmail_base = str_replace( '.', '', explode( '@', $email )[0] );
-        $gmail_base = preg_replace( '/[+].*$/', '', $gmail_base );
-
-        $matching_email = $wpdb->get_var( $sql = $wpdb->prepare(
-            'SELECT `user_email` FROM %i WHERE `user_email` = %s LIMIT 1',
-            "{$wpdb->base_prefix}user_pending_registrations",
-            $gmail_base . '@gmail.com'
-        ) );
-
-        if ( $matching_email ) {
-            return wporg_get_pending_user( $matching_email );
-        }
-    }
-
-    return false;
-}
-
-/**
  * Update the pending user record, similar to `wp_update_user()` but for the not-yet-created user record.
  */
 function wporg_update_pending_user( $pending_user ) {
     global $wpdb;
+
+    // Ensure we have the sanitized email for searching purposes.
+    if ( empty( $pending_user['user_email_san'] ) && ! empty( $pending_user['user_email'] ) ) {
+        $pending_user['user_email_san'] = wporg_sanitize_email_for_search( $pending_user['user_email'] );
+    }
 
     // Allow altering the user fields.
@@ -604 +580 @@
     return false;
 }
+
+/**
+ * Sanitize an email into it's canonical form for searching.
+ *
+ * @param string $email The email address to sanitize.
+ * @return string The sanitized email address.
+ */
+function wporg_sanitize_email_for_search( $email ) {
+    $email_san = strtolower( $email );
+    $email_san = trim( $email_san );
+
+    // Remove plus addressing for the sanitized email.
+    $email_san = preg_replace( '/[+][^@]+@/i', '@', $email_san );
+
+    // Filter it when needed.
+    $email_san = apply_filters( 'wporg_sanitize_email_for_search', $email_san, $email );
+
+    return $email_san;
+}

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/functions-restapi.php

@@ -114 +114 @@
     // Check we don't have a pending registration for that email.
     $pending = wporg_get_pending_user( $email );
-
-    // And that there's no pending account signups for other emails for that inbox.
-    if ( ! $pending && str_contains( $email, '+' ) ) {
-        $pending = wporg_get_pending_user_by_email_wildcard( $email );
-    }
 
     if ( $pending && ! $pending['created'] && ! $pending['cleared'] ) {