← All changes | authorizer.php +27 -23 2.8.3 → 2.8.0 View file →

		@@ -6,9 +6,9 @@
6	6	* Plugin URI: https://github.com/uhm-coe/authorizer
7	7	* Text Domain: authorizer
8	8	* Domain Path: /languages
9	9	* License: GPL2
10		- * Version: 2.8.3
	10	+ * Version: 2.8.0
11	11	*
12	12	* @package authorizer
13	13	*/
14	14
		@@ -43,9 +43,9 @@
43	43	/**
44	44	* Constants for determining our admin context (network or individual site).
45	45	*/
46	46	const NETWORK_CONTEXT = 'multisite_admin';
47		- const SINGLE_CONTEXT = 'single_admin';
	47	+ const SINGLE_CONTEXT = 'single_admin';
48	48
49	49	/**
50	50	* Current site ID (Multisite).
51	51	*
		@@ -264,18 +264,22 @@
264	264	* Will also activate the plugin for all sites/blogs if this is a "Network enable."
265	265	*
266	266	* @return void
267	267	*/
268		- public function activate( $network_wide ) {
	268	+ public function activate() {
269	269	global $wpdb;
270	270
271		- // If we're in a multisite environment, run the plugin activation for each
272		- // site when network enabling.
273		- // Note: wp-cli does not use nonces, so we skip the nonce check here to
274		- // allow the "wp plugin activate authorizer" command.
275		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
276		- if ( is_multisite() && $network_wide ) {
	271	+ // Nonce check.
	272	+ if (
	273	+ ! isset( $_REQUEST['_wpnonce'], $_REQUEST['plugin'] ) ||
	274	+ ! wp_verify_nonce( sanitize_key( $_REQUEST['_wpnonce'] ), 'activate-plugin_' . sanitize_text_field( wp_unslash( $_REQUEST['plugin'] ) ) )
	275	+ ) {
	276	+ die( '' );
	277	+ }
277	278
	279	+ // If we're in a multisite environment, run the plugin activation for each site when network enabling.
	280	+ if ( is_multisite() && isset( $_GET['networkwide'] ) && 1 === intval( $_GET['networkwide'] ) ) {
	281	+
278	282	// Add super admins to the multisite approved list.
279	283	$auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() );
280	284	$should_update_auth_multisite_settings_access_users_approved = false;
281	285	foreach ( get_super_admins() as $super_admin ) {
		@@ -1289,9 +1293,9 @@
1289	1293	// Set the CAS service URL (including the redirect URL for WordPress when it comes back from CAS).
1290	1294	$cas_service_url = site_url( '/wp-login.php?external=cas' );
1291	1295	$login_querystring = array();
1292	1296	if ( isset( $_SERVER['QUERY_STRING'] ) ) {
1293		- parse_str( $_SERVER['QUERY_STRING'], $login_querystring ); // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
	1297	+ parse_str( wp_parse_url( esc_url_raw( wp_unslash( $_SERVER['QUERY_STRING'] ) ), PHP_URL_HOST ), $login_querystring );
1294	1298	}
1295	1299	if ( isset( $login_querystring['redirect_to'] ) ) {
1296	1300	$cas_service_url .= '&redirect_to=' . rawurlencode( $login_querystring['redirect_to'] );
1297	1301	}
		@@ -1939,9 +1943,9 @@
1939	1943	*/
1940	1944	public function auth_public_scripts() {
1941	1945	// Load (and localize) public scripts.
1942	1946	$current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url();
1943		- wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
	1947	+ wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1944	1948	$auth_localized = array(
1945	1949	'wpLoginUrl' => wp_login_url( $current_path ),
1946	1950	'publicWarning' => get_option( 'auth_settings_advanced_public_notice' ),
1947	1951	'anonymousNotice' => $this->get_plugin_option( 'access_redirect_to_message' ),
		@@ -1949,9 +1953,9 @@
1949	1953	);
1950	1954	wp_localize_script( 'auth_public_scripts', 'auth', $auth_localized );
1951	1955
1952	1956	// Load public css.
1953		- wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.8.0' );
	1957	+ wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.3.2' );
1954	1958	wp_enqueue_style( 'authorizer-public-css' );
1955	1959	}
1956	1960
1957	1961
		@@ -1966,12 +1970,12 @@
1966	1970	// Grab plugin settings.
1967	1971	$auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
1968	1972
1969	1973	// Enqueue scripts appearing on wp-login.php.
1970		- wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
	1974	+ wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1971	1975
1972	1976	// Enqueue styles appearing on wp-login.php.
1973		- wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.8.0' );
	1977	+ wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.3.2' );
1974	1978	wp_enqueue_style( 'authorizer-login-css' );
1975	1979
1976	1980	/**
1977	1981	* Developers can use the `authorizer_add_branding_option` filter
		@@ -1996,10 +2000,10 @@
1996	2000	if ( ! ( is_array( $branding_option ) && array_key_exists( 'value', $branding_option ) && array_key_exists( 'css_url', $branding_option ) && array_key_exists( 'js_url', $branding_option ) ) ) {
1997	2001	continue;
1998	2002	}
1999	2003	if ( $auth_settings['advanced_branding'] === $branding_option['value'] ) {
2000		- wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.8.0' );
2001		- wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.8.0' );
	2004	+ wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.3.2' );
	2005	+ wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.3.2' );
2002	2006	wp_enqueue_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ) );
2003	2007	}
2004	2008	}
2005	2009
		@@ -2004,9 +2008,9 @@
2004	2008	}
2005	2009
2006	2010	// If we're using Google logins, load those resources.
2007	2011	if ( '1' === $auth_settings['google'] ) {
2008		- wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.8.0' ); ?>
	2012	+ wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.3.2' ); ?>
2009	2013	<meta name="google-signin-clientid" content="<?php echo esc_attr( $auth_settings['google_clientid'] ); ?>" />
2010	2014	<meta name="google-signin-scope" content="email" />
2011	2015	<meta name="google-signin-cookiepolicy" content="single_host_origin" />
2012	2016	<?php
		@@ -2120,9 +2124,9 @@
2120	2124	</span>
2121	2125	</a></p>
2122	2126	<?php endif; ?>
2123	2127
2124		- <?php if ( '1' === $auth_settings['advanced_hide_wp_login'] && isset( $_SERVER['QUERY_STRING'] ) && false === strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) ) : // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput ?>
	2128	+ <?php if ( '1' === $auth_settings['advanced_hide_wp_login'] && isset( $_SERVER['QUERY_STRING'] ) && false === strpos( wp_parse_url( esc_url_raw( wp_unslash( $_SERVER['QUERY_STRING'] ) ), PHP_URL_HOST ), 'external=wordpress' ) ) : ?>
2125	2129	<style type="text/css">
2126	2130	body.login-action-login form {
2127	2131	padding-bottom: 8px;
2128	2132	}
		@@ -2162,9 +2166,9 @@
2162	2166
2163	2167	// Check whether we should redirect to CAS.
2164	2168	if (
2165	2169	isset( $_SERVER['QUERY_STRING'] ) &&
2166		- strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false && // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
	2170	+ strpos( wp_parse_url( esc_url_raw( wp_unslash( $_SERVER['QUERY_STRING'] ) ), PHP_URL_HOST ), 'external=wordpress' ) === false &&
2167	2171	array_key_exists( 'cas_auto_login', $auth_settings ) && '1' === $auth_settings['cas_auto_login'] &&
2168	2172	array_key_exists( 'cas', $auth_settings ) && '1' === $auth_settings['cas'] &&
2169	2173	( ! array_key_exists( 'ldap', $auth_settings ) || '1' !== $auth_settings['ldap'] ) &&
2170	2174	( ! array_key_exists( 'google', $auth_settings ) || '1' !== $auth_settings['google'] ) &&
		@@ -2399,9 +2403,9 @@
2399	2403	public function load_options_page() {
2400	2404	wp_enqueue_script(
2401	2405	'authorizer',
2402	2406	plugins_url( 'js/authorizer.js', __FILE__ ),
2403		- array( 'jquery-effects-shake' ), '2.8.0', true
	2407	+ array( 'jquery-effects-shake' ), '2.7.2', true
2404	2408	);
2405	2409	wp_localize_script(
2406	2410	'authorizer', 'authL10n', array(
2407	2411	'baseurl' => get_bloginfo( 'url' ),
		@@ -2485,12 +2489,12 @@
2485	2489	$auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2486	2490
2487	2491	if ( '1' === $auth_settings['cas'] ) :
2488	2492	// Check if provided CAS URL is accessible.
2489		- $protocol = in_array( strval( $auth_settings['cas_port'] ), array( '80', '8080' ), true ) ? 'http' : 'https';
2490		- $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
	2493	+ $protocol = in_array( strval( $auth_settings['cas_port'] ), array( '80', '8080' ), true ) ? 'http' : 'https';
	2494	+ $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
2491	2495	$legacy_cas_url = trailingslashit( $cas_url ) . 'login'; // Check the specific CAS login endpoint (old; some servers don't register a ./login endpoint, use serviceValidate instead).
2492		- $cas_url = trailingslashit( $cas_url ) . 'serviceValidate'; // Check the specific CAS login endpoint.
	2496	+ $cas_url = trailingslashit( $cas_url ) . 'serviceValidate'; // Check the specific CAS login endpoint.
2493	2497	if ( ! $this->url_is_accessible( $cas_url ) && ! $this->url_is_accessible( $legacy_cas_url ) ) :
2494	2498	$authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
2495	2499	?>
2496	2500	<div class='notice notice-warning is-dismissible'>