Changeset 9961 for sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

Timestamp:

06/15/2020 07:19:57 AM (6 years ago)

Author:

dd32

Message:

SSO: When determining the login url, always include a redirect_to if the host is not under the wordpress.org domain.

This prevents login failures with browsers that don't send http referers cross-origin, such as the Brave browser.

See #5239.

File:

• sites/trunk/common/includes/wporg-sso/class-wporg-sso.php (modified) (1 diff)

sites/trunk/common/includes/wporg-sso/class-wporg-sso.php

@@ -78 +78 @@
                         $login_url = $this->sso_login_url;
 
+                        if ( ! preg_match( '!wordpress\.org$!', $this->host ) ) {
+                                $login_url = add_query_arg( 'from', $this->host, $login_url );
+
+                                // Not all browsers send referers cross-origin, ensure that a redirect_to is set for this hostname.
+                                if ( empty( $redirect_to ) ) {
+                                        $redirect_to = 'https://' . $this->host . $_SERVER['REQUEST_URI'];
+                                }
+                        }
+
                         if ( ! empty( $redirect_to ) && $this->_is_valid_targeted_domain( $redirect_to ) ) {
                                 $redirect_to = preg_replace( '/\/wp-(login|signup)\.php\??.*$/', '/', $redirect_to );
                                 $login_url = add_query_arg( 'redirect_to', urlencode( $redirect_to ), $login_url );
-                        }
-
-                        if ( ! preg_match( '!wordpress\.org$!', $this->host ) ) {
-                                $login_url = add_query_arg( 'from', $this->host, $login_url );
                         }