Upgrade GitHub OAuth Usage

[pento]

I received this email from GitHub with regards to how WordPress.org authenticates GitHub profiles.

Hello there!

On February 26th, 2020 at 00:18 (PST), your application (WordPress.org Profiles) issued a request using the deprecated form of OAuth Application API that includes access tokens in the URL path. GitHub has deprecated these endpoints and replaced them with a version that accepts access tokens in the request body.

The deprecated endpoints will be removed on July 1st, 2020 at 4:00 PM UTC.

Please visit ​https://developer.github.com/changes/2020-02-14-deprecating-oauth-app-endpoint for more information about suggested changes, brownouts, and removal dates.

Thanks,
The GitHub Team

[dd32]

I've been looking into this today, it looks like it affects the DELETE unlinking functionality, so should be a simple change.

[afragen]

What GitHub is doing is deprecating the auth token in a query arg.

The solution is to use the same auth token in a Basic Auth header.

The format from the http_request_args filter is

$args['headers']['Authorization'] = token my_current_auth_token';

Assuming the authentication is via wp_remote_get()

[dd32]

I think this is fixed as of r15784-dotorg.

class-api-endpoint.php

@@ -47 +47 @@
 
                 // Revoke our access to that users token
                 $api = $this->make_api_request(
-                        '/applications/' . CLIENT_ID . '/grants/' . $access_token,
-                        null,
+                        '/applications/' . CLIENT_ID . '/grant',
+                        json_encode( [ 'access_token' => $access_token ] ),
                         [ 'Authorization' => 'BASIC ' . base64_encode( CLIENT_ID . ':' . CLIENT_SECRET ) ],
                         'DELETE'
                 );

[dd32]

Looks like that was all that was affected based on the Endpoints affected listing on ​https://developer.github.com/changes/2020-02-14-deprecating-oauth-app-endpoint/

wporg-profiles-github-link$ grep '/token' . -r
No Results

wporg-profiles-github-link$ grep '/grant' . -r
./class-api-endpoint.php:			'/applications/' . CLIENT_ID . '/grant',