#17793 - Name the allowed characters in the invalid username error

src/wp-admin/includes/user.php

@@ -194,7 +194,7 @@ function edit_user( $user_id = 0 ) {
 	}
 
 	if ( ! $update && isset( $_POST['user_login'] ) && ! validate_username( $_POST['user_login'] ) ) {
-		$errors->add( 'user_login', __( '<strong>Error:</strong> This username is invalid because it uses illegal characters. Please enter a valid username.' ) );
+		$errors->add( 'user_login', __( '<strong>Error:</strong> This username is invalid because it uses illegal characters. Usernames can only contain letters (a-z), numbers (0-9), dashes (-), underscores (_), and periods (.).' ) );
 	}
 
 	if ( ! $update && username_exists( $user->user_login ) ) {

src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -1322,7 +1322,7 @@ public function check_username( $value, $request, $param ) {
 		if ( ! validate_username( $username ) ) {
 			return new WP_Error(
 				'rest_user_invalid_username',
-				__( 'This username is invalid because it uses illegal characters. Please enter a valid username.' ),
+				__( 'This username is invalid because it uses illegal characters. Usernames can only contain letters (a-z), numbers (0-9), dashes (-), underscores (_), and periods (.).' ),
 				array( 'status' => 400 )
 			);
 		}

src/wp-includes/user.php

@@ -3568,7 +3568,7 @@ function register_new_user( $user_login, $user_email ) {
 	if ( '' === $sanitized_user_login ) {
 		$errors->add( 'empty_username', __( '<strong>Error:</strong> Please enter a username.' ) );
 	} elseif ( ! validate_username( $user_login ) ) {
-		$errors->add( 'invalid_username', __( '<strong>Error:</strong> This username is invalid because it uses illegal characters. Please enter a valid username.' ) );
+		$errors->add( 'invalid_username', __( '<strong>Error:</strong> This username is invalid because it uses illegal characters. Usernames can only contain letters (a-z), numbers (0-9), dashes (-), underscores (_), and periods (.).' ) );
 		$sanitized_user_login = '';
 	} elseif ( username_exists( $sanitized_user_login ) ) {
 		$errors->add( 'username_exists', __( '<strong>Error:</strong> This username is already registered. Please choose another one.' ) );

tests/phpunit/tests/rest-api/rest-users-controller.php

@@ -1416,7 +1416,7 @@ public function test_create_item_invalid_username() {
 			$this->assertIsArray( $data['data']['params'] );
 			$errors = $data['data']['params'];
 			$this->assertIsString( $errors['username'] );
-			$this->assertSame( 'This username is invalid because it uses illegal characters. Please enter a valid username.', $errors['username'] );
+			$this->assertSame( 'This username is invalid because it uses illegal characters. Usernames can only contain letters (a-z), numbers (0-9), dashes (-), underscores (_), and periods (.).', $errors['username'] );
 		}
 	}
 

tests/phpunit/tests/user.php

@@ -1202,6 +1202,39 @@ public function test_illegal_user_logins_single_wp_create_user( $user_login ) {
 		$this->assertInstanceOf( 'WP_User', $user );
 	}
 
+	/**
+	 * The error message for an invalid username should tell the user which
+	 * characters are allowed.
+	 *
+	 * @ticket 17793
+	 * @dataProvider data_invalid_usernames
+	 *
+	 * @param string $user_login A username that contains disallowed characters.
+	 */
+	public function test_register_new_user_invalid_username_message( $user_login ) {
+		$response = register_new_user( $user_login, 'testuser@example.com' );
+
+		$this->assertInstanceOf( 'WP_Error', $response );
+		$this->assertSame( 'invalid_username', $response->get_error_code() );
+
+		$this->assertStringContainsString(
+			'Usernames can only contain letters (a-z), numbers (0-9), dashes (-), underscores (_), and periods (.).',
+			$response->get_error_message()
+		);
+	}
+
+	/**
+	 * Data provider for test_register_new_user_invalid_username_message().
+	 *
+	 * @return array[] Test parameters.
+	 */
+	public function data_invalid_usernames() {
+		return array(
+			'accented characters' => array( 'jösé' ),
+			'disallowed symbol'   => array( 'testuser*' ),
+		);
+	}
+
 	/**
 	 * @ticket 27317
 	 * @group ms-required