← All changes | includes/blocks/logout/block.php +106 -6 2.10.0 → 2.15.0 View file →

		@@ -18,8 +18,97 @@
18	18
19	19	class Block extends BlockBaseAbstract {
20	20	protected $block_name = 'logout';
21	21
	22	+ /**
	23	+ * Query arg carrying the signature of a block-issued logout redirect URL.
	24	+ */
	25	+ const REDIRECT_SIGNATURE_ARG = 'ablocks_rs';
	26	+
	27	+ public function __construct( $keep_silent = false ) {
	28	+ parent::__construct( $keep_silent );
	29	+
	30	+ if ( $this->is_enabled_block() && ! $keep_silent ) {
	31	+ add_filter( 'allowed_redirect_hosts', array( $this, 'allow_signed_logout_redirect_host' ) );
	32	+ }
	33	+ }
	34	+
	35	+ /**
	36	+ * wp-login.php ends a logout with wp_safe_redirect(), which swaps any host
	37	+ * outside `allowed_redirect_hosts` for admin_url() — so a custom URL on
	38	+ * another domain never took effect. Allow that host for this one request,
	39	+ * and only when the redirect carries a signature this block produced from
	40	+ * the site's secret salts: a hand-made or edited `redirect_to` stays
	41	+ * rejected, so this is not an open redirect.
	42	+ *
	43	+ * @param string[] $hosts Allowed hosts.
	44	+ * @return string[]
	45	+ */
	46	+ public function allow_signed_logout_redirect_host( $hosts ) {
	47	+ global $pagenow;
	48	+
	49	+ // phpcs:disable WordPress.Security.NonceVerification.Recommended -- wp-login.php verifies the log-out nonce itself; this only reads the redirect target.
	50	+ if (
	51	+ 'wp-login.php' !== $pagenow ||
	52	+ ! isset( $_REQUEST['action'], $_REQUEST['redirect_to'], $_REQUEST[ self::REDIRECT_SIGNATURE_ARG ] ) ||
	53	+ 'logout' !== $_REQUEST['action'] ||
	54	+ ! is_string( $_REQUEST['redirect_to'] ) ||
	55	+ ! is_string( $_REQUEST[ self::REDIRECT_SIGNATURE_ARG ] )
	56	+ ) {
	57	+ return $hosts;
	58	+ }
	59	+
	60	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- compared against an HMAC, never output.
	61	+ $redirect = wp_unslash( $_REQUEST['redirect_to'] );
	62	+ $signature = sanitize_text_field( wp_unslash( $_REQUEST[ self::REDIRECT_SIGNATURE_ARG ] ) );
	63	+ // phpcs:enable WordPress.Security.NonceVerification.Recommended
	64	+
	65	+ if ( ! hash_equals( self::sign_redirect_url( $redirect ), $signature ) ) {
	66	+ return $hosts;
	67	+ }
	68	+
	69	+ $host = wp_parse_url( $redirect, PHP_URL_HOST );
	70	+ if ( $host ) {
	71	+ $hosts[] = $host;
	72	+ }
	73	+
	74	+ return $hosts;
	75	+ }
	76	+
	77	+ private static function sign_redirect_url( $url ) {
	78	+ return wp_hash( 'ablocks-logout-redirect|' . $url, 'nonce' );
	79	+ }
	80	+
	81	+ /**
	82	+ * Normalize the configured custom URL, falling back to the home URL for an
	83	+ * empty, non-HTTP(S) or malformed value.
	84	+ *
	85	+ * @param string $url Configured URL.
	86	+ * @return string
	87	+ */
	88	+ private static function sanitize_custom_redirect_url( $url ) {
	89	+ $url = esc_url_raw( trim( (string) $url ), array( 'http', 'https' ) );
	90	+ if ( '' === $url ) {
	91	+ return home_url();
	92	+ }
	93	+
	94	+ $parts = wp_parse_url( $url );
	95	+ if ( false === $parts ) {
	96	+ return home_url();
	97	+ }
	98	+
	99	+ // esc_url_raw() turns bare text such as "not a url" into "http://notaurl";
	100	+ // a real destination is either this site's host or a dotted domain name.
	101	+ if ( isset( $parts['host'] ) ) {
	102	+ $home_host = wp_parse_url( home_url(), PHP_URL_HOST );
	103	+ if ( $parts['host'] !== $home_host && false === strpos( $parts['host'], '.' ) ) {
	104	+ return home_url();
	105	+ }
	106	+ }
	107	+
	108	+ return $url;
	109	+ }
	110	+
22	111	public function build_css( $attributes ) {
23	112	$css_generator = new CssGeneratorV2( $attributes, $this->block_name );
24	113
25	114	$css_generator->add_class_styles(
		@@ -30,9 +119,10 @@
30	119	$css_generator->add_class_styles(
31	120	'{{WRAPPER}} .ablocks-block-logout',
32	121	$this->get_log_out_css( $attributes ),
33	122	$this->get_log_out_css( $attributes, 'Tablet' ),
34		- $this->get_log_out_css( $attributes, 'Mobile' )
	123	+ $this->get_log_out_css( $attributes, 'Mobile' ),
	124	+ $css_generator->custom_device_map( function ( $device ) use ( $attributes ) { return $this->get_log_out_css( $attributes, $device ); } )
35	125	);
36	126	$css_generator->add_class_styles(
37	127	'{{WRAPPER}} .ablocks-block-logout__name',
38	128	$this->get_name_css( $attributes )
		@@ -41,15 +131,17 @@
41	131	$css_generator->add_class_styles(
42	132	'{{WRAPPER}} .ablocks-block-logout__avatar',
43	133	$this->get_avatar_css( $attributes ),
44	134	$this->get_avatar_css( $attributes, 'Tablet' ),
45		- $this->get_avatar_css( $attributes, 'Mobile' )
	135	+ $this->get_avatar_css( $attributes, 'Mobile' ),
	136	+ $css_generator->custom_device_map( function ( $device ) use ( $attributes ) { return $this->get_avatar_css( $attributes, $device ); } )
46	137	);
47	138	$css_generator->add_class_styles(
48	139	'{{WRAPPER}} .ablocks-block-logout__avatar:hover',
49	140	$this->get_avatar_border_hover_css( $attributes ),
50	141	$this->get_avatar_border_hover_css( $attributes, 'Tablet' ),
51		- $this->get_avatar_border_hover_css( $attributes, 'Mobile' )
	142	+ $this->get_avatar_border_hover_css( $attributes, 'Mobile' ),
	143	+ $css_generator->custom_device_map( function ( $device ) use ( $attributes ) { return $this->get_avatar_border_hover_css( $attributes, $device ); } )
52	144	);
53	145
54	146	return $css_generator->generate_css();
55	147	}
		@@ -137,11 +229,9 @@
137	229	if ( $logout_redirect_option === 'current-url' ) {
138	230	// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
139	231	$logout_redirect_url = ( is_ssl() ? 'https://' : 'http://' ) . sanitize_text_field( $_SERVER['HTTP_HOST'] ) . sanitize_text_field( $_SERVER['REQUEST_URI'] );
140	232	} elseif ( $logout_redirect_option === 'custom-url' ) {
141		- $logout_redirect_url = isset( $attributes['logoutCustomUrl'] ) && ! empty( $attributes['logoutCustomUrl'] )
142		- ? esc_url( $attributes['logoutCustomUrl'] )
143		- : home_url();
	233	+ $logout_redirect_url = self::sanitize_custom_redirect_url( isset( $attributes['logoutCustomUrl'] ) ? $attributes['logoutCustomUrl'] : '' );
144	234	}
145	235
146	236	$login_redirect_option = isset( $attributes['loginRedirect'] ) ? $attributes['loginRedirect'] : 'current-url';
147	237
		@@ -171,8 +261,18 @@
171	261	? ( isset( $attributes['logOutLabel'] ) ? sanitize_text_field( $attributes['logOutLabel'] ) : __( '(Log Out)', 'ablocks' ) )
172	262	: ( isset( $attributes['logInLabel'] ) ? sanitize_text_field( $attributes['logInLabel'] ) : __( '(Log In)', 'ablocks' ) );
173	263
174	264	$action_url = $is_logged_in ? wp_logout_url( $logout_redirect_url ) : wp_login_url( $login_redirect_url );
	265	+
	266	+ if ( $is_logged_in && 'custom-url' === $logout_redirect_option ) {
	267	+ // wp_logout_url() returns an HTML-escaped URL; decode it before adding
	268	+ // the arg, the anchor below escapes it again.
	269	+ $action_url = add_query_arg(
	270	+ self::REDIRECT_SIGNATURE_ARG,
	271	+ self::sign_redirect_url( $logout_redirect_url ),
	272	+ html_entity_decode( $action_url, ENT_QUOTES )
	273	+ );
	274	+ }
175	275
176	276	ob_start();
177	277	?>
178	278	<div class="ablocks-block-logout">