Changeset 12556

Timestamp:

04/24/2023 06:20:49 AM (3 years ago)

Author:

dd32

Message:

Login: SSO: When validating SSO tokens for logging into non-wordpress.org domains, respect the session token (if present).

File:

• sites/trunk/common/includes/wporg-sso/wp-plugin.php (modified) (1 diff)

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -749 +749 @@
             if ( $user ) {
                 $valid_hash = hash_equals(
-                    $this->_generate_remote_token_hash( $user, $valid_until, $remember_me ),
+                    $this->_generate_remote_token_hash( $user, $valid_until, $remember_me, $session_token ),
                     $sso_hash
                 );