Changeset 12239 for sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

Timestamp:

11/11/2022 05:10:24 AM (4 years ago)

Author:

dd32

Message:

Login: SSO: When you logout from a WordPress.org network, logout from all networks.

This causes a logout on wordcamp.org to log you out of wordpress.org and vice-versa.

This is needed as WordPress.org doesn't use shared Sessions with WordCamp.org, BuddyPress.org, and bbPress.org, but shares credentials and a central login screen.

File:

• sites/trunk/common/includes/wporg-sso/class-wporg-sso.php (modified) (3 diffs)

sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

@@ -12 +12 @@
                 const LOGIN_TOS_COOKIE  = 'wporg_tos_login';
                 const TOS_USER_META_KEY = 'tos_revision';
+
+                /**
+                 * The time SSO tokens are valid. These are used for remote login/logout on
+                 * non-wordpress.org domains.
+                 *
+                 * @var int
+                 */
+                const REMOTE_TOKEN_TIMEOUT = 5;
 
                 const VALID_HOSTS = [
@@ -186 +194 @@
                  * Tests if the passed host/domain, or URL, is part of the WordPress.org network.
                  *
-                 * @param unknown $host A domain, hostname, or URL
+                 * @param string $host A domain, hostname, or URL
                  * @return boolean True is ok, false if not
                  */
@@ -202 +210 @@
                         }
 
+                        $host = $this->_get_targetted_host( $host );
+
+                        return in_array( $host, self::VALID_HOSTS, true );
+                }
+
+                /**
+                 * Determine the targetted hostname for a given hostname.
+                 *
+                 * This returns 'wordpress.org' in the case of 'login.wordpress.org'.
+                 * This does NOT validate the hostname is valid for a redirect.
+                 *
+                 * @param string $host The hostname to process.
+                 * @return string The hostname, maybe top-level, maybe not.
+                 */
+                protected function _get_targetted_host( $host ) {
                         if ( in_array( $host, self::VALID_HOSTS, true ) ) {
-                                return true;
+                                return $host;
                         }
 
                         // If not a top-level domain, shrink it down and try again.
                         $top_level_host = implode( '.', array_slice( explode( '.', $host ), -2 ) );
-
-                        return in_array( $top_level_host, self::VALID_HOSTS, true );
+                        if ( in_array( $top_level_host, self::VALID_HOSTS, true ) ) {
+                                $host = $top_level_host;
+                        }
+
+                        return $host;
                 }