Changeset 12759

Timestamp:

07/25/2023 05:02:49 AM (3 years ago)

Author:

dd32

Message:

Login: SSO: When logging out, we no longer need to logout of every network individually, logging out of login.wordpress.org will correctly terminate the session on all sites.

Partially reverts [12239].

File:

• sites/trunk/common/includes/wporg-sso/wp-plugin.php (modified) (3 diffs)

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -528 +528 @@
                         $user = wp_get_current_user();
 
-                        // Perform the logout on this network first.
-                        wp_logout();
-
                         // Redirect back to the requested location.. the referer.. or failing that, the current sites front page after it's all done.
                         $logout_redirect = ( wp_unslash( $_REQUEST['redirect_to'] ?? '' ) ?: wp_get_referer() ) ?: home_url( '/' );
+
+                        // Never to wp-admin.
+                        if ( str_contains( $logout_redirect, '/wp-admin/' ) ) {
+                                $logout_redirect = home_url( '/' );
+                        }
+
                         $logout_redirect = apply_filters( 'logout_redirect', $logout_redirect, $logout_redirect, $user );
 
@@ -539 +542 @@
                                         'action'         => 'remote-logout',
                                         'redirect_to'    => urlencode( $logout_redirect ),
-                                        'loggedout_on[]' => urlencode( $this->_get_targetted_host( $this->host ) ),
                                         'sso_logout'     => urlencode( $this->_generate_remote_token( $user ) )
                                 ),
@@ -643 +645 @@
 
                 /**
-                 * Log out a user from all sites and networks.
-                 *
-                 * This works by keeping track of the domains logged out on, and redirecting the user to the next
-                 * site in self::VALID_HOSTS. Each is only requested once, so the user should experience minimal
-                 * redirects.
+                 * Log out a user and destroy the session.
                  */
                 protected function _maybe_perform_remote_logout() {
-                        if ( empty( $_GET['sso_logout'] ) ) {
+                        if ( empty( $_GET['sso_logout'] ) || ! $this->is_sso_host() ) {
                                 return;
                         }
 
+                        // Validate the logout token.
                         $remote_token = wp_unslash( $_GET['sso_logout'] );
                         $remote_token = $this->_validate_remote_token( $remote_token );
-
                         if ( ! $remote_token || ! $remote_token['valid'] ) {
                                 return;
                         }
-                        $user = $remote_token['user'];
-
-                        // If the matching user is logged in, log them out.
-                        // If they're logged in as someone else, that's problematic, but we ignore that intentionally.
-                        if ( is_user_logged_in() && get_current_user_id() == $user->ID ) {
-                                wp_logout();
-                        }
-
-                        // Hosts logged out on..
-                        $logged_out_on     = (array) $_REQUEST['loggedout_on'] ?? [];
-                        $logged_out_on[]   = $this->_get_targetted_host( $this->host );
-                        $need_to_logout_on = array_diff( self::VALID_HOSTS, $logged_out_on );
-
-                        // Logged out everywhere, send them over to the logout confirmation screen.
-                        if ( ! $need_to_logout_on ) {
-                                $final_url = $this->sso_host_url . '/loggedout';
-
-                                if ( ! empty( $_REQUEST['redirect_to'] ) ) {
-                                        $final_url = add_query_arg( 'redirect_to', $_REQUEST['redirect_to'], $final_url );
+
+                        // Perform the logout. This will destroy the session, logging the user out of all sites.
+                        wp_logout();
+
+                        // Default to the logout confirmation screen, or back to the source site if possible.
+                        $redirect_to = $this->sso_host_url . '/loggedout';
+                        if ( ! empty( $_REQUEST['redirect_to'] ) ) {
+                                $requested_redirect_to = urldecode( wp_unslash( $_REQUEST['redirect_to'] ) );
+                                $redirect_to           = add_query_arg( 'redirect_to', urlencode( $requested_redirect_to ), $redirect_to );
+
+                                // If the requested redirect_to is valid, use it.
+                                if ( wp_validate_redirect( $requested_redirect_to ) ) {
+                                        $redirect_to = $requested_redirect_to;
                                 }
-
-                                $this->_safe_redirect( $final_url );
-                                exit;
-                        }
-
-                        // Redirect on to the next host in self::VALID_HOSTS to logout from.
-                        $logout_redirect = add_query_arg(
-                                array(
-                                        'action'       => 'remote-logout',
-                                        'sso_logout'   => urlencode( $this->_generate_remote_token( $user ) ),
-                                        'redirect_to'  => urlencode( wp_unslash( $_REQUEST['redirect_to'] ?? '' ) ),
-                                        'loggedout_on' => array_values( $logged_out_on )
-                                ),
-                                'https://' . reset( $need_to_logout_on ) . '/wp-login.php'
-                        );
-
-                        $this->_safe_redirect( $logout_redirect );
+                        }
+
+                        $this->_safe_redirect( $redirect_to );
                         exit;
                 }