Changeset 12232

Timestamp:

11/10/2022 03:59:53 AM (2 years ago)

Author:

dd32

Message:

Login: SSO: Pass a full URI to _safe_redirect() and remove relative-url support.

Supporting relative URIs causes some redirects to land on the incorrect domain.

Location:

sites/trunk/common/includes/wporg-sso

Files:

• class-wporg-sso.php (modified) (1 diff)
• wp-plugin.php (modified) (1 diff)

sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

@@ -231 +231 @@
             }
 
-            // If it's a full URI, validate the host.
-            if ( ! str_starts_with( $to, '/' ) && ! $this->_is_valid_targeted_domain( $to ) ) {
+            // This function MUST be passed a full URI, a relative or root-relative URI is not valid.
+            if ( ! $this->_is_valid_targeted_domain( $to ) ) {
                 $to = $this->_get_safer_redirect_to();
             }

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -551 +551 @@
                 wp_set_current_user( (int) $user_id );
                 wp_set_auth_cookie( (int) $user_id, (bool) $remember_me );
-
-                if ( isset( $_GET['redirect_to'] ) ) {
-                    $this->_safe_redirect( wp_unslash( $_GET['redirect_to'] ) );
-
-                } elseif ( ! str_contains( $this->script, '/wp-login.php' ) ) {
-                    // SSO login, no redirect_url, and on a not-a-login page. Remove sso arg and redirect to self.
-                    $this->_safe_redirect( remove_query_arg( 'sso_token' ) );
-
-                } else {
-                    $this->_safe_redirect( home_url( '/' ) );
-
-                }
-                exit;
+            }
+
+            if ( isset( $_GET['redirect_to'] ) ) {
+                $redirect_to = wp_unslash( $_GET['redirect_to'] );
             } else {
-                // Invalid auth, remove the query var.
-                $this->_safe_redirect( remove_query_arg( 'sso_token' ) );
-                exit;
-            }
-
-            return false;
+                // Generate the current url based on the current hostname and request uri.
+                $redirect_to = set_url_scheme( 'http://' . $this->host . ( $_SERVER['REQUEST_URI'] ?? '/' ) );
+
+                // Remove the sso_token parameter, as we've now used it.
+                $redirect_to = remove_query_arg( 'sso_token', $redirect_to );
+            }
+
+            // If we're going to land on a login page, go back home to avoid a potential endless loop.
+            if ( str_contains( $redirect_to, '/wp-login.php' ) ) {
+                $redirect_to = home_url( '/' );
+            }
+
+            $this->_safe_redirect( $redirect_to );
+            exit;
         }