Changeset 4470 for sites/trunk/common/includes/wporg-sso/wp-plugin.php

Timestamp:

12/04/2016 05:54:55 PM (8 years ago)

Author:

dd32

Message:

Login.WordPress.org: Allow user registration through login.wordpress.org

This change does many things, including, but not limited to:

• Making all the routes have proper templates, rather than being template-parts
• Removing all the extra WordPress functionalities and outputs
• Adding the Registration pages and routes
• Updating SSO to handle routes with URL params
• Adding rest endpoints for username/email validation

See #148, #1524

File:

• sites/trunk/common/includes/wporg-sso/wp-plugin.php (modified) (5 diffs)

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -22 +22 @@
             'lostpassword' => '/lostpassword',
             'oauth'        => '/oauth',
+            'register-profile' => '/register/profile/(?P<profile_user>[^/]+)/(?P<profile_nonce>[^/]+)',
+            'register-confirm' => '/register/confirm/(?P<confirm_user>[^/]+)/(?P<confirm_key>[^/]+)',
+            'register'         => '/register',
         );
+
+        /**
+         * Holds the route hit in `valid_sso_paths`
+         * @var bool|string
+         */
+        static $matched_route = false;
+
+        /**
+         * Holds any matched route params.
+         * @var array
+         */
+        static $matched_route_params = array();
 
         /**
@@ -70 +85 @@
          */
         public function disable_password_reset_for_blocked_users( $allow, $user_id ) {
-            if ( ! defined( 'WPORG_SUPPORT_FORUMS_BLOGID' ) ) {
+            if ( ! $allow || ! defined( 'WPORG_SUPPORT_FORUMS_BLOGID' ) ) {
                 return $allow;
             }
@@ -76 +91 @@
             $user = new WP_User( $user_id, '', WPORG_SUPPORT_FORUMS_BLOGID );
             $is_blocked = ! empty( $user->allcaps['bbp_blocked'] );
+
             return ! $is_blocked;
         }
@@ -150 +166 @@
                 if ( ! preg_match( '!/wp-login\.php$!', $this->script ) ) {
                     // ... but not on its login screen.
-                    if ( preg_match( '!^(' . implode( '|', $this->valid_sso_paths ) . ')([/?]{1,2}.*)?$!', $_SERVER['REQUEST_URI'] ) ) {
-                        // If we're on the path of interest
-
+                    self::$matched_route = false;
+                    self::$matched_route_params = array();
+                    foreach ( $this->valid_sso_paths as $route => $regex ) {
+                        if ( preg_match( '!^' . $regex . '(?:[/?]{1,2}.*)?$!', $_SERVER['REQUEST_URI'], $matches ) ) {
+                            self::$matched_route = $route;
+                            self::$matched_route_params = $matches;
+                            break;
+                        }
+                    }
+
+                    // If we're on the path of interest
+                    if ( self::$matched_route ) {
                         // Add a custom filter others can apply (theme, etc).
                         add_filter( 'is_valid_wporg_sso_path' , '__return_true' );
@@ -187 +212 @@
                             }
                         }
+                    } elseif ( ( is_admin() && is_super_admin() ) || preg_match( '!^/wp-json(/?$|/.+)!i', $_SERVER['REQUEST_URI'] ) ) {
+                        // Do nothing, allow access to wp-admin and wp-json on login.wordpress.org
                     } elseif ( is_user_logged_in() ) {
                         // Logged in catch all, before last fallback