Changeset 61656

Timestamp:

02/17/2026 05:48:04 AM (6 weeks ago)

Author:

westonruter

Message:

Users: Ensure user data supplied to wp_insert_user() is normalized to an array.

This fixes an issue where PHPStan hangs when analyzing the containing users.php file.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/10953

Follow-up to [60650].

Props westonruter, justlevine, peterwilsoncc.
See #64238, #61175.

Location:

trunk

Files:

• src/wp-includes/user.php (modified) (2 diffs)
• tests/phpunit/tests/user.php (modified) (1 diff)

trunk/src/wp-includes/user.php

@@ -2210 +2210 @@
     } elseif ( $userdata instanceof WP_User ) {
         $userdata = $userdata->to_array();
+    } elseif ( $userdata instanceof Traversable ) {
+        $userdata = iterator_to_array( $userdata );
+    } elseif ( $userdata instanceof ArrayAccess ) {
+        $userdata_obj = $userdata;
+        $userdata     = array();
+        foreach (
+            array(
+                'ID',
+                'user_pass',
+                'user_login',
+                'user_nicename',
+                'user_url',
+                'user_email',
+                'display_name',
+                'nickname',
+                'first_name',
+                'last_name',
+                'description',
+                'rich_editing',
+                'syntax_highlighting',
+                'comment_shortcuts',
+                'admin_color',
+                'use_ssl',
+                'user_registered',
+                'user_activation_key',
+                'spam',
+                'show_admin_bar_front',
+                'role',
+                'locale',
+                'meta_input',
+            ) as $key
+        ) {
+            if ( isset( $userdata_obj[ $key ] ) ) {
+                $userdata[ $key ] = $userdata_obj[ $key ];
+            }
+        }
+    } else {
+        $userdata = (array) $userdata;
     }
 
@@ -2245 +2283 @@
     }
 
-    $sanitized_user_login = sanitize_user( $userdata['user_login'], true );
+    $sanitized_user_login = sanitize_user( $userdata['user_login'] ?? '', true );
 
     /**

trunk/tests/phpunit/tests/user.php

@@ -984 +984 @@
 
     /**
+     * @ticket 61175
+     * @covers ::wp_insert_user
+     */
+    public function test_wp_insert_user_with_null() {
+        // Note: $this->expectWarning() is deprecated and will be removed in PHPUnit 10.
+        $warnings = array();
+        set_error_handler(
+            static function ( int $errno, string $errstr ) use ( &$warnings ) {
+                $warnings[] = compact( 'errno', 'errstr' );
+                return true;
+            },
+            E_USER_WARNING
+        );
+        $user = wp_insert_user( null );
+        restore_error_handler();
+
+        $this->assertCount( 1, $warnings, 'Expected one warning.' );
+        $this->assertWPError( $user );
+        $this->assertSame( 'empty_user_login', $user->get_error_code() );
+    }
+
+    /**
+     * @ticket 61175
+     * @covers ::wp_insert_user
+     */
+    public function test_wp_insert_user_with_stdclass() {
+        $data    = array(
+            'user_login' => 'new-admin',
+            'user_pass'  => 'better-password',
+        );
+        $user_id = wp_insert_user( (object) $data );
+        $this->assertIsInt( $user_id, 'Expected user to be created.' );
+        $user = new WP_User( $user_id );
+        $this->assertSame( $data['user_login'], $user->user_login );
+    }
+
+    /**
+     * @ticket 61175
+     * @covers ::wp_insert_user
+     */
+    public function test_wp_insert_user_with_wp_user() {
+        $username         = 'new-admin';
+        $user             = new WP_User();
+        $user->user_login = $username;
+        $user->user_pass  = 'better-password';
+
+        $user_id = wp_insert_user( $user );
+        $this->assertIsInt( $user_id, 'Expected user to be created.' );
+        $user = new WP_User( $user_id );
+        $this->assertSame( $username, $user->user_login );
+    }
+
+    /**
+     * @ticket 61175
+     * @covers ::wp_insert_user
+     */
+    public function test_wp_insert_user_with_traversable() {
+        $internal_data = array(
+            'user_login' => 'new-admin',
+            'user_pass'  => 'better-password',
+        );
+
+        $array_access_user = new class( $internal_data ) implements ArrayAccess, IteratorAggregate {
+            private array $data;
+
+            public function __construct( array $data ) {
+                $this->data = $data;
+            }
+
+            public function offsetExists( $offset ): bool {
+                return isset( $this->data[ $offset ] );
+            }
+
+            #[\ReturnTypeWillChange]
+            public function offsetGet( $offset ) {
+                return $this->data[ $offset ];
+            }
+
+            public function offsetSet( $offset, $value ): void {
+                $this->data[ $offset ] = $value;
+            }
+
+            public function offsetUnset( $offset ): void {
+                unset( $this->data[ $offset ] );
+            }
+
+            public function getIterator(): ArrayIterator {
+                return new ArrayIterator( $this->data );
+            }
+        };
+
+        $user_id = wp_insert_user( $array_access_user );
+        $this->assertIsInt( $user_id, 'Expected user to be created.' );
+        $user = new WP_User( $user_id );
+        $this->assertSame( $internal_data['user_login'], $user->user_login );
+    }
+
+    /**
+     * @ticket 61175
+     * @covers ::wp_insert_user
+     */
+    public function test_wp_insert_user_with_only_array_access() {
+        $internal_data = array(
+            'user_login' => 'new-admin',
+            'user_pass'  => 'better-password',
+        );
+
+        $array_access_user = new class( $internal_data ) implements ArrayAccess  {
+            private array $data;
+
+            public function __construct( array $data ) {
+                $this->data = $data;
+            }
+
+            public function offsetExists( $offset ): bool {
+                return isset( $this->data[ $offset ] );
+            }
+
+            #[\ReturnTypeWillChange]
+            public function offsetGet( $offset ) {
+                return $this->data[ $offset ];
+            }
+
+            public function offsetSet( $offset, $value ): void {
+                $this->data[ $offset ] = $value;
+            }
+
+            public function offsetUnset( $offset ): void {
+                unset( $this->data[ $offset ] );
+            }
+        };
+
+        $user_id = wp_insert_user( $array_access_user );
+        $this->assertIsInt( $user_id, 'Expected user to be created.' );
+        $user = new WP_User( $user_id );
+        $this->assertSame( $internal_data['user_login'], $user->user_login );
+    }
+
+    /**
      * @ticket 27317
      * @dataProvider data_illegal_user_logins