Changeset 2150 for sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

Timestamp:

12/03/2015 03:14:47 PM (9 years ago)

Author:

stephdau

Message:

WPORG SSO (login.wordpress.org):

• Adding an WPOrg_SSO::has_host() method to test if we have $_SERVERHTTP_HOST?
• Testing for WPOrg_SSO::has_host() before proceeding,no need to if we don;t have one (EG: cron'd processes)
• Adding a $_SERVER['HTTP_REFERER'] test to WPOrg_SSO::_get_safer_redirect_to(), which now also enables SSO for our Trac instances (see #1422) and improves it for our BB instances (see #1423).

File:

• sites/trunk/common/includes/wporg-sso/class-wporg-sso.php (modified) (3 diffs)

sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

@@ -24 +24 @@
             $this->sso_signup_url = 'https://wordpress.org/support/register.php'; // For now
             
-            $this->host   = $_SERVER['HTTP_HOST'];
-            $this->script = $_SERVER['SCRIPT_NAME'];
+            if ( ! empty( $_SERVER['HTTP_HOST'] ) ) {
+                $this->host   = $_SERVER['HTTP_HOST'];
+                $this->script = $_SERVER['SCRIPT_NAME'];
+            }
         }
         
@@ -78 +80 @@
         }
         
+        
+        /**
+         * Tests if the current process has $_SERVER['HTTP_HOST'] or not (EG: cron'd processes do not).
+         * 
+         * @return boolean
+         */
+        public function has_host() {
+            return ( ! empty( $this->host ) );
+        }
+        
         /**
          * Get a safe redirect URL (ie: a wordpress.org-based one) from $_REQUEST['redirect_to'] or a safe alternative.
@@ -93 +105 @@
                     $redirect_to = $redirect_to_requested;
                 }
-            } else {
+            } else if ( ! empty( $_SERVER['HTTP_REFERER'] ) ) {
+                // We didn't get a redirect_to, but we got a referrer, use that if a valid target.
+                $redirect_to_referrer = $_SERVER['HTTP_REFERER'];
+                if ( $this->_is_valid_targeted_domain( $redirect_to_referrer ) ) {
+                    $redirect_to = $redirect_to_referrer;
+                }
+            } else{
                 // Otherwise, attempt to guess the parent dir of where they came from and validate that.
                 $redirect_to_source_parent = preg_replace( '/\/[^\/]+\.php\??.*$/', '/', "https://{$this->host}{$_SERVER['REQUEST_URI']}" );