Changeset 14446

Timestamp:

05/01/2025 05:22:26 AM (8 months ago)

Author:

dd32

Message:

Login: SSO: Don't urldecode the redirect_to value, as PHP will have already done that for us.

Resolves WordCamp tickets missing acces tokens after login redirects.

See ​https://github.com/WordPress/wordcamp.org/pull/1469

File:

• sites/trunk/common/includes/wporg-sso/wp-plugin.php (modified) (3 diffs)

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -383 +383 @@
                                     $get['redirect_to'] = $this->_get_safer_redirect_to();
                                 }
-                                $this->_safe_redirect( add_query_arg( $get, $this->sso_host_url . '/wp-login.php' ), 301 );
+                                $this->_safe_redirect( add_query_arg( urlencode_deep( $get ), $this->sso_host_url . '/wp-login.php' ), 301 );
                                 return;
                             } else {
@@ -505 +505 @@
 
             if ( ! empty( $redirect ) ) {
-                $lostpassword_url = add_query_arg( 'redirect_to', $redirect, $lostpassword_url );
+                $lostpassword_url = add_query_arg( 'redirect_to', urlencode( $redirect ), $lostpassword_url );
             }
 
@@ -705 +705 @@
             $redirect_to = $this->sso_host_url . '/loggedout';
             if ( ! empty( $_REQUEST['redirect_to'] ) ) {
-                $requested_redirect_to = urldecode( wp_unslash( $_REQUEST['redirect_to'] ) );
+                $requested_redirect_to = wp_unslash( $_REQUEST['redirect_to'] );
                 $redirect_to           = add_query_arg( 'redirect_to', urlencode( $requested_redirect_to ), $redirect_to );