Registration: Reject usernames that contain "www."

Wordpress registration e-mails are used to send bitcoin spam to
people - by using usernames with spaces like
> www.spammer.example.com - 1.2342 BTC

This patch filters out usernames that begin with "www."
or contain " www." - such names are auto-linked by email
clients and made clickable.

Documented occurences of that spamming problem:
- https://cweiske.de/tagebuch/wordpress-registration-spam.htm
- https://www.reddit.com/r/Wordpress/comments/1gyyhx7/spammed_with_100_fake_wordpress_login_emails_help/

Fixes 63085.

Author: cweiske

src/wp-includes/default-filters.php

@@ -393,6 +393,9 @@
 add_action( 'login_init', 'send_frame_options_header', 10, 0 );
 add_action( 'login_init', 'wp_admin_headers' );
 
+// Registration
+add_filter( 'validate_username', 'wp_validate_username_spam' );
+
 // Feed generator tags.
 foreach ( array( 'rss2_head', 'commentsrss2_head', 'rss_head', 'rdf_header', 'atom_head', 'comments_atom_head', 'opml_head', 'app_head' ) as $action ) {
 	add_action( $action, 'the_generator' );

src/wp-includes/user.php

@@ -5094,6 +5094,22 @@ function wp_validate_user_request_key(
 	return true;
 }
 
+/**
+ * Reject usernames that can be used for spamming people.
+ *
+ * @param string $username Username to check.
+ * @return bool Whether username given is valid.
+ */
+function wp_validate_username_spam( $username ) {
+	//username begins with "www." or has " www." in it,
+	// which gets auto-linked by email clients
+	if (strpos(' ' . $username, ' www.') !== false) {
+		return false;
+	}
+
+	return true;
+}
+
 /**
  * Returns the user request object for the specified request ID.
  *