Changeset 9961

Timestamp:

06/15/2020 07:19:57 AM (5 years ago)

Author:

dd32

Message:

SSO: When determining the login url, always include a redirect_to if the host is not under the wordpress.org domain.

This prevents login failures with browsers that don't send http referers cross-origin, such as the Brave browser.

See #5239.

File:

• sites/trunk/common/includes/wporg-sso/class-wporg-sso.php (modified) (1 diff)

sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

@@ -78 +78 @@
             $login_url = $this->sso_login_url;
 
+            if ( ! preg_match( '!wordpress\.org$!', $this->host ) ) {
+                $login_url = add_query_arg( 'from', $this->host, $login_url );
+
+                // Not all browsers send referers cross-origin, ensure that a redirect_to is set for this hostname.
+                if ( empty( $redirect_to ) ) {
+                    $redirect_to = 'https://' . $this->host . $_SERVER['REQUEST_URI'];
+                }
+            }
+
             if ( ! empty( $redirect_to ) && $this->_is_valid_targeted_domain( $redirect_to ) ) {
                 $redirect_to = preg_replace( '/\/wp-(login|signup)\.php\??.*$/', '/', $redirect_to );
                 $login_url = add_query_arg( 'redirect_to', urlencode( $redirect_to ), $login_url );
-            }
-
-            if ( ! preg_match( '!wordpress\.org$!', $this->host ) ) {
-                $login_url = add_query_arg( 'from', $this->host, $login_url );
             }