[Plugin: Shibboleth] Username at risk of breaking permalinks with %author%

Hrrm, do you have a working solution in place for something like this?

It’s something I’ve been looking into myself, I just haven’t had time to devote to it.

I’ve actually just disabled the %author% urls in my theme for the time being.

Zooney,

My solution is to add the filter I mentioned in my original post:
add_filter( 'shibboleth_user_nicename', 'sanitize_title');
You can either create a single plugin with this line, or, to keep it simple, you can just add it in the shibboleth.php code.

I’ve added mine just above
$shib_headers = shibboleth_get_option('shibboleth_headers');
inside the shibboleth_update_user_data function.

Hopefully this can be integrated into future releases.

@guychisholm, this is mitcho, the new committer on the Shibboleth WP plugin.

I’m interested in adding a sanitize filter to the nicename, as you suggest, but I’m not sure why you’re using sanitize_title. Why not the sanitize_name command?

@mitcho, long time ago now, but I suspect I picked sanitize_title because of wp-includes/registration.php#L132.

I assume you mean sanitize_user, rather than sanitize_name? If this is the case then, I would agree that this is more appropriate than sanitize_title. Interesting that this method is not used in the core registration…

…oh wait! They do ?? My bad

Woo-hoo! We have a maintainer!

Question though about this fix… does this filter need to be in place prior to the generation of accounts?

…or, are you adding a filter using apply_filters as well?

Any help would be hugely appreciated here! =)

I’m beginning to see the issue here.

I already have a wp_users table with the entire user_nicename column filled in with unsanitized user_nicenames due to using the shibboleth plugin without this filter.

@guychisholm does the filter method you use work when there are pre-existing user accounts?

Also, I’m wondering how this works at all seeing that, given the logic in shibboleth_update_user_data and the structure of the ‘shibboleth_headers’ array, user_nicename will never be updated unless $force_update is true, since it has no ‘managed’ key in the ‘shibboleth_headers’ array.

@mitcho is it possible to suggest as part of an upgrade, the ability to fix previously entered user_nicenames created by the shibboleth plugin? If not I’ll have to run some kind of script on my database myself to clean this up…

Although, thanks to both of you for the huge leg up in finally locating what the issue here actually was… ??

@zooney Yes, this fix only runs at account generation time. No reason why you shouldn’t update the database to fix the existing users.

@guychisholm Gotcha, actually, I can switch that $force_update parameter in the shibboleth_authenticate_user function, but, the likelyhood that I can get everyone to re-log to make sure they all get fixed is pretty slim. =)

I’ll just run the script.

Incidentally, its essentially impossible to change user_login after it’s been created in WordPress, right? My guess is that wp_update_user can’t touch that.

If so, I wish I had known about these filters before I started using the plugin. =)

Oh well… live and learn.

@mitcho I apologize for just thinking out loud here, but, I think I see why sanitize_title is a better choice than sanitize_user.

sanitize_user seems to still allow the ‘@’ and ‘.’ characters (I’m assuming for an LDAP-style username) and that character will cause problems with the %author% links.

sanitize_title seems to strip out ‘@’ along with ‘.’ and other characters, which seem to be what’s keeping the %author% links from working.

This is particularly important with shibboleth since EPPNs tend to be of the form [email protected]

…I suppose I should use some other attribute for the username, but I’ve found that adding something like:

if( $shib_headers['username']['name'] == 'eppn' ) {
  $username = sanitize_title( $username );
}

…after line 272 in shibboleth.php (in shibboleth_authenticate_user) is useful in making a friendlier username from the eppn.

So, would it be possible to add a filter for $username, or some other way of modifying the username supplied by the headers before it’s used to actually create the account? It’d be useful to have some control over the form of usernames in wordpress after they’re taken from the Shibboleth headers.

So excited to see a new Shib plugin version. Thanks guys!

I do have a question though. I see that one of the fixes is:
“now applies sanitize_name() to the Shibboleth user’s nicename column”

According to this thread shouldn’t that be ‘sanitize_title()’? We tried the new plugin and new Shibboleth users still have a nicename like [email protected] instead of something that works like foobar-com. If I change the plugin to use sanitize_title I get my desired result (i.e. the Authors plugin works).

Am I confused? Thanks again!