Changeset 12759

Timestamp:

07/25/2023 05:02:49 AM (3 years ago)

Author:

dd32

Message:

Login: SSO: When logging out, we no longer need to logout of every network individually, logging out of login.wordpress.org will correctly terminate the session on all sites.

Partially reverts [12239].

File:

• sites/trunk/common/includes/wporg-sso/wp-plugin.php (modified) (3 diffs)

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -528 +528 @@
             $user = wp_get_current_user();
 
-            // Perform the logout on this network first.
-            wp_logout();
-
             // Redirect back to the requested location.. the referer.. or failing that, the current sites front page after it's all done.
             $logout_redirect = ( wp_unslash( $_REQUEST['redirect_to'] ?? '' ) ?: wp_get_referer() ) ?: home_url( '/' );
+
+            // Never to wp-admin.
+            if ( str_contains( $logout_redirect, '/wp-admin/' ) ) {
+                $logout_redirect = home_url( '/' );
+            }
+
             $logout_redirect = apply_filters( 'logout_redirect', $logout_redirect, $logout_redirect, $user );
 
@@ -539 +542 @@
                     'action'         => 'remote-logout',
                     'redirect_to'    => urlencode( $logout_redirect ),
-                    'loggedout_on[]' => urlencode( $this->_get_targetted_host( $this->host ) ),
                     'sso_logout'     => urlencode( $this->_generate_remote_token( $user ) )
                 ),
@@ -643 +645 @@
 
         /**
-         * Log out a user from all sites and networks.
-         *
-         * This works by keeping track of the domains logged out on, and redirecting the user to the next
-         * site in self::VALID_HOSTS. Each is only requested once, so the user should experience minimal
-         * redirects.
+         * Log out a user and destroy the session.
          */
         protected function _maybe_perform_remote_logout() {
-            if ( empty( $_GET['sso_logout'] ) ) {
+            if ( empty( $_GET['sso_logout'] ) || ! $this->is_sso_host() ) {
                 return;
             }
 
+            // Validate the logout token.
             $remote_token = wp_unslash( $_GET['sso_logout'] );
             $remote_token = $this->_validate_remote_token( $remote_token );
-
             if ( ! $remote_token || ! $remote_token['valid'] ) {
                 return;
             }
-            $user = $remote_token['user'];
-
-            // If the matching user is logged in, log them out.
-            // If they're logged in as someone else, that's problematic, but we ignore that intentionally.
-            if ( is_user_logged_in() && get_current_user_id() == $user->ID ) {
-                wp_logout();
-            }
-
-            // Hosts logged out on..
-            $logged_out_on     = (array) $_REQUEST['loggedout_on'] ?? [];
-            $logged_out_on[]   = $this->_get_targetted_host( $this->host );
-            $need_to_logout_on = array_diff( self::VALID_HOSTS, $logged_out_on );
-
-            // Logged out everywhere, send them over to the logout confirmation screen.
-            if ( ! $need_to_logout_on ) {
-                $final_url = $this->sso_host_url . '/loggedout';
-
-                if ( ! empty( $_REQUEST['redirect_to'] ) ) {
-                    $final_url = add_query_arg( 'redirect_to', $_REQUEST['redirect_to'], $final_url );
+
+            // Perform the logout. This will destroy the session, logging the user out of all sites.
+            wp_logout();
+
+            // Default to the logout confirmation screen, or back to the source site if possible.
+            $redirect_to = $this->sso_host_url . '/loggedout';
+            if ( ! empty( $_REQUEST['redirect_to'] ) ) {
+                $requested_redirect_to = urldecode( wp_unslash( $_REQUEST['redirect_to'] ) );
+                $redirect_to           = add_query_arg( 'redirect_to', urlencode( $requested_redirect_to ), $redirect_to );
+
+                // If the requested redirect_to is valid, use it.
+                if ( wp_validate_redirect( $requested_redirect_to ) ) {
+                    $redirect_to = $requested_redirect_to;
                 }
-
-                $this->_safe_redirect( $final_url );
-                exit;
-            }
-
-            // Redirect on to the next host in self::VALID_HOSTS to logout from.
-            $logout_redirect = add_query_arg(
-                array(
-                    'action'       => 'remote-logout',
-                    'sso_logout'   => urlencode( $this->_generate_remote_token( $user ) ),
-                    'redirect_to'  => urlencode( wp_unslash( $_REQUEST['redirect_to'] ?? '' ) ),
-                    'loggedout_on' => array_values( $logged_out_on )
-                ),
-                'https://' . reset( $need_to_logout_on ) . '/wp-login.php'
-            );
-
-            $this->_safe_redirect( $logout_redirect );
+            }
+
+            $this->_safe_redirect( $redirect_to );
             exit;
         }