Conversation
The error shown when a username contains disallowed characters only asked for "a valid username" without saying what is valid. Multisite already names the allowed characters in wpmu_validate_user_signup(), so single site was the outlier. Update the message in register_new_user(), edit_user(), and the REST users controller. The REST copy deliberately keeps no HTML prefix, since REST error messages are plain text. Refs #17793
The REST users controller test pinned the old string with assertSame(), so it needed updating. Add coverage for the registration path, for an accented username and for a disallowed symbol. Refs #17793
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Unlinked AccountsThe following contributors have not linked their GitHub and WordPress.org accounts: @skikken. Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases. To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
1 participant
When a username is rejected for containing disallowed characters, the error only said the username was invalid and asked for "a valid username". That does not tell the person registering which characters are actually accepted, so the message did not help them correct the problem.
The message now names the allowed characters. This matches what multisite already reports through wpmu_validate_user_signup() ("Usernames can only contain lowercase letters (a-z) and numbers."), so single site registration was the outlier rather than this being a new direction.
The string appears in three places and all three were updated: register_new_user(), edit_user() in wp-admin, and the users REST controller. The REST copy is the same message without the "Error:" prefix, since REST errors are not rendered as admin notices.
A username can also contain a space or an @, because both survive sanitize_user(). Listing those was raised on the ticket and deliberately left out: the recommendation there was to avoid encouraging them, and advertising them as valid would need sanitize_user() tightened first, which is a much larger change than this ticket.
Trac ticket: https://core.trac.wordpress.org/ticket/17793
Use of AI Tools
AI assistance: Yes
Tool(s): Claude
Model(s): Sonnet
Used for: test cases, code review
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.