Users: Add extra checking to wp_new_user_notification().

Prevent a notification from being sent when an unrecognised value is passed in the `$notify` parameter.

Props cthreelabs, 360zen.
Fixes #44293.


Built from https://develop.svn.wordpress.org/trunk@44611


git-svn-id: http://core.svn.wordpress.org/trunk@44442 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Author: pento

wp-includes/pluggable.php

@@ -1894,6 +1894,11 @@ function wp_new_user_notification( $user_id, $deprecated = null, $notify = '' )
 			_deprecated_argument( __FUNCTION__, '4.3.1' );
 		}
 
+		// Accepts only 'user', 'admin' , 'both' or default '' as $notify
+		if ( ! in_array( $notify, array( 'user', 'admin', 'both', '' ), true ) ) {
+			return;
+		}
+
 		global $wpdb, $wp_hasher;
 		$user = get_userdata( $user_id );
 

wp-includes/version.php

@@ -13,7 +13,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '5.1-beta1-44610';
+$wp_version = '5.1-beta1-44611';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.