Networks and Sites: Improve search term handling in wp_ajax_autocomplete_user()

src/wp-admin/includes/ajax-actions.php

@@ -285,6 +285,10 @@ function wp_ajax_oembed_cache() {
  * Handles user autocomplete via AJAX.
  *
  * @since 3.4.0
+ * @since 7.1.0 The search term is now sanitized, and a missing, non-string,
+ *              or empty term results in a `0` response instead of an empty array.
+ *
+ * @return never
  */
 function wp_ajax_autocomplete_user() {
 	if ( ! is_multisite() || ! current_user_can( 'promote_users' ) || wp_is_large_network( 'users' ) ) {
@@ -298,6 +302,20 @@ function wp_ajax_autocomplete_user() {
 
 	$return = array();
 
+	// Obtain the search term, and short-circuit missing/invalid search term.
+	if ( ! isset( $_REQUEST['term'] ) || ! is_string( $_REQUEST['term'] ) ) {
+		wp_die( 0 );
+	}
+	/*
+	 * Asterisks are trimmed since wildcards are appended below. Without this, a
+	 * term consisting only of asterisks would result in an empty search that
+	 * matches all users.
+	 */
+	$term = trim( sanitize_text_field( wp_unslash( $_REQUEST['term'] ) ), '*' );
+	if ( '' === $term ) {
+		wp_die( 0 );
+	}
+
 	/*
 	 * Check the type of request.
 	 * Current allowed values are `add` and `search`.
@@ -342,7 +360,7 @@ function wp_ajax_autocomplete_user() {
 	$users = get_users(
 		array(
 			'blog_id'        => false,
-			'search'         => '*' . $_REQUEST['term'] . '*',
+			'search'         => '*' . $term . '*',
 			'include'        => $include_blog_users,
 			'exclude'        => $exclude_blog_users,
 			'search_columns' => array( 'user_login', 'user_nicename', 'user_email' ),