Changeset 2204

Timestamp:

12/18/2015 05:32:19 PM (9 years ago)

Author:

stephdau

Message:

WPORG SSO (login.worpress.org): relax redirect rule to allow themeing of /oauth/* paths on SSO host (upcoming).

File:

• sites/trunk/common/includes/wporg-sso/wp-plugin.php (modified) (2 diffs)

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -63 +63 @@
                     // And actually redirect to the SSO login
                     $this->_safe_redirect( $redirect_to_sso_login );
+                
                 } else {
                     // Otherwise, filter the login_url to point to the SSO
                     add_action( 'login_url', array( &$this, 'login_url' ), 10, 2 );
                 }
+            
             } else if ( self::SSO_HOST === $this->host ) {
                 // If on the SSO host
                 if ( ! preg_match( '/\/wp-login\.php$/', $this->script ) ) {
-                    // ... but not on its login or signup screen.
-                    // TODO: Relax rules when we want more  out of our theme then bypassing it altogether with redirects.
-                    if ( is_user_logged_in() ) {
-                        // Mimic what happens after a login without a specified redirect.
+                    // ... but not on its login screen.
+                    if ( preg_match( '/^\/oauth([\/\?]{1}.*)?$/', $_SERVER['REQUEST_URI'] ) ) {
+                        // Let the theme render for oauth paths (/oauth, /oauth/, /oauth/*, but not /notoauth or /oauthnot)
+                        return;
+                    } else  if ( is_user_logged_in() ) {
+                        // Or mimic what happens after a login without a specified redirect (send to profile).
                         $this->_safe_redirect( 'https://wordpress.org/support/profile/' . get_currentuserinfo()->user_login );
                     } else {
@@ -79 +83 @@
                         $this->_safe_redirect( $this->sso_login_url );
                     }
+                
                 } else {
                     // if on login screen, filter network_site_url to make sure our forms go to the SSO host, not wordpress.org