Changeset 12428

Timestamp:

02/27/2023 05:44:29 AM (3 years ago)

Author:

dd32

Message:

WordPress.org SSO: Pass the WordPress Session token through the remote-login bounce (for non-.wordpress.org domains), so that the session on either side of the request will match.

File:

• sites/trunk/common/includes/wporg-sso/wp-plugin.php (modified) (9 diffs)

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -92 +92 @@
 
                     // Updated TOS interceptor.
-                    add_filter( 'send_auth_cookies', [ $this, 'maybe_block_auth_cookies' ], 100, 4 );
+                    add_filter( 'send_auth_cookies', [ $this, 'maybe_block_auth_cookies' ], 100, 5 );
                 }
             }
@@ -585 +585 @@
             if ( $remote_token && $remote_token['valid'] && $remote_token['user'] ) {
                 wp_set_current_user( $remote_token['user']->ID );
-                wp_set_auth_cookie( $remote_token['user']->ID, (bool) $remote_token['remember_me'] );
+                wp_set_auth_cookie( $remote_token['user']->ID, (bool) $remote_token['remember_me'], true, $remote_token['session_token'] );
             }
 
@@ -704 +704 @@
              * This is only useful for login tokens, but causes no harm for loggout tokens.
              */
-            $auth_cookie_parts = wp_parse_auth_cookie( '', 'secure_auth' );
+            $auth_cookie_parts = wp_parse_auth_cookie( '', 'logged_in' );
             $remember_me       = ! empty( $_POST['rememberme'] ) || ( $auth_cookie_parts && $auth_cookie_parts['expiration'] >= ( time() + ( 2 * DAY_IN_SECONDS ) ) );
-
-            $hash        = $this->_generate_remote_token_hash( $user, $valid_until, $remember_me );
-            $sso_token   = $user->ID . '|' . $hash . '|' . $valid_until . '|' . $remember_me;
+            $session_token     = wp_get_session_token();
+
+            $hash        = $this->_generate_remote_token_hash( $user, $valid_until, $remember_me, $session_token );
+            $sso_token   = $user->ID . '|' . $hash . '|' . $valid_until . '|' . $remember_me . '|' . $session_token;
 
             return $sso_token;
@@ -716 +717 @@
          * Generate a hash for remote-login for non-wordpress.org domains
          */
-        protected function _generate_remote_token_hash( $user, $valid_until, $remember_me = false ) {
+        protected function _generate_remote_token_hash( $user, $valid_until, $remember_me = false, $session_token = '' ) {
             // re-use the same frag that Auth cookies use to invalidate sessions.
             $pass_frag = substr( $user->user_pass, 8, 4 );
-            $key       = wp_hash( $user->user_login . '|' . $pass_frag . '|' . $valid_until, 'wporg_sso' );
-            $hash      = hash_hmac( 'sha256', $user->user_login . '|' . $valid_until . '|' . (int) $remember_me, $key );
+            $key       = wp_hash( $user->user_login . '|' . $pass_frag . '|' . $valid_until . '|' . $session_token, 'wporg_sso' );
+            $hash      = hash_hmac( 'sha256', $user->user_login . '|' . $valid_until . '|' . (int) $remember_me . '|' . $session_token, $key );
 
             return $hash;
@@ -731 +732 @@
          * @return array If the token was valid.
          */
-        protected function _validate_remote_token( $token ) {
-            if ( ! is_string( $token ) || 3 !== substr_count( $token, '|' ) ) {
+        protected function _validate_remote_token( $sso_token ) {
+            if ( ! is_string( $sso_token ) || 4 !== substr_count( $sso_token, '|' ) ) {
                 wp_die( 'Invalid token.' );
             }
 
-            list( $user_id, $sso_hash, $valid_until, $remember_me ) = explode( '|', $token, 4 );
+            list( $user_id, $sso_hash, $valid_until, $remember_me, $session_token ) = explode( '|', $sso_token, 4 );
 
             $expiration_valid = (
@@ -753 +754 @@
             }
 
+            // Validate that the remote login token is valid.
             $valid = ( $expiration_valid && $valid_hash );
 
@@ -758 +760 @@
                 'valid',
                 'user',
-                'remember_me'
+                'remember_me',
+                'session_token'
             );
         }
@@ -777 +780 @@
          * to the updated policy interstitial if required.
          */
-        public function maybe_block_auth_cookies( $send_cookies, $expire, $expiration, $user_id ) {
+        public function maybe_block_auth_cookies( $send_cookies, $expire, $expiration, $user_id, $token = '' ) {
             if (
                 $user_id &&
@@ -785 +788 @@
 
                 // Set a cookie so that we can keep the user in a auth'd (but not) state.
-                $token_cookie = wp_generate_auth_cookie( $user_id, time() + HOUR_IN_SECONDS, 'tos_token' );
+                $token_cookie = wp_generate_auth_cookie( $user_id, time() + HOUR_IN_SECONDS, 'tos_token', $token );
                 $remember_me  = ( 0 !== $expire );