Changeset 2150 for sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

Timestamp:

12/03/2015 03:14:47 PM (11 years ago)

Author:

stephdau

Message:

WPORG SSO (login.wordpress.org):

• Adding an WPOrg_SSO::has_host() method to test if we have $_SERVERHTTP_HOST
• Testing for WPOrg_SSO::has_host() before proceeding,no need to if we don;t have one (EG: cron'd processes)
• Adding a $_SERVER['HTTP_REFERER'] test to WPOrg_SSO::_get_safer_redirect_to(), which now also enables SSO for our Trac instances (see #1422) and improves it for our BB instances (see #1423).

File:

• sites/trunk/common/includes/wporg-sso/class-wporg-sso.php (modified) (3 diffs)

sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

@@ -24 +24 @@
                         $this->sso_signup_url = 'https://wordpress.org/support/register.php'; // For now
                         
-                        $this->host   = $_SERVER['HTTP_HOST'];
-                        $this->script = $_SERVER['SCRIPT_NAME'];
+                        if ( ! empty( $_SERVER['HTTP_HOST'] ) ) {
+                                $this->host   = $_SERVER['HTTP_HOST'];
+                                $this->script = $_SERVER['SCRIPT_NAME'];
+                        }
                 }
                 
@@ -78 +80 @@
                 }
                 
+                
+                /**
+                 * Tests if the current process has $_SERVER['HTTP_HOST'] or not (EG: cron'd processes do not).
+                 * 
+                 * @return boolean
+                 */
+                public function has_host() {
+                        return ( ! empty( $this->host ) );
+                }
+                
                 /**
                  * Get a safe redirect URL (ie: a wordpress.org-based one) from $_REQUEST['redirect_to'] or a safe alternative.
@@ -93 +105 @@
                                         $redirect_to = $redirect_to_requested;
                                 }
-                        } else {
+                        } else if ( ! empty( $_SERVER['HTTP_REFERER'] ) ) {
+                                // We didn't get a redirect_to, but we got a referrer, use that if a valid target.
+                                $redirect_to_referrer = $_SERVER['HTTP_REFERER'];
+                                if ( $this->_is_valid_targeted_domain( $redirect_to_referrer ) ) {
+                                        $redirect_to = $redirect_to_referrer;
+                                }
+                        } else{
                                 // Otherwise, attempt to guess the parent dir of where they came from and validate that.
                                 $redirect_to_source_parent = preg_replace( '/\/[^\/]+\.php\??.*$/', '/', "https://{$this->host}{$_SERVER['REQUEST_URI']}" );