← All changes | authorizer.php +33 -39 2.8.4 → 2.8.0 View file →

		@@ -6,9 +6,9 @@
6	6	* Plugin URI: https://github.com/uhm-coe/authorizer
7	7	* Text Domain: authorizer
8	8	* Domain Path: /languages
9	9	* License: GPL2
10		- * Version: 2.8.4
	10	+ * Version: 2.8.0
11	11	*
12	12	* @package authorizer
13	13	*/
14	14
		@@ -43,9 +43,9 @@
43	43	/**
44	44	* Constants for determining our admin context (network or individual site).
45	45	*/
46	46	const NETWORK_CONTEXT = 'multisite_admin';
47		- const SINGLE_CONTEXT = 'single_admin';
	47	+ const SINGLE_CONTEXT = 'single_admin';
48	48
49	49	/**
50	50	* Current site ID (Multisite).
51	51	*
		@@ -264,18 +264,22 @@
264	264	* Will also activate the plugin for all sites/blogs if this is a "Network enable."
265	265	*
266	266	* @return void
267	267	*/
268		- public function activate( $network_wide ) {
	268	+ public function activate() {
269	269	global $wpdb;
270	270
271		- // If we're in a multisite environment, run the plugin activation for each
272		- // site when network enabling.
273		- // Note: wp-cli does not use nonces, so we skip the nonce check here to
274		- // allow the "wp plugin activate authorizer" command.
275		- // phpcs:ignore WordPress.CSRF.NonceVerification.NoNonceVerification
276		- if ( is_multisite() && $network_wide ) {
	271	+ // Nonce check.
	272	+ if (
	273	+ ! isset( $_REQUEST['_wpnonce'], $_REQUEST['plugin'] ) ||
	274	+ ! wp_verify_nonce( sanitize_key( $_REQUEST['_wpnonce'] ), 'activate-plugin_' . sanitize_text_field( wp_unslash( $_REQUEST['plugin'] ) ) )
	275	+ ) {
	276	+ die( '' );
	277	+ }
277	278
	279	+ // If we're in a multisite environment, run the plugin activation for each site when network enabling.
	280	+ if ( is_multisite() && isset( $_GET['networkwide'] ) && 1 === intval( $_GET['networkwide'] ) ) {
	281	+
278	282	// Add super admins to the multisite approved list.
279	283	$auth_multisite_settings_access_users_approved = get_blog_option( $this->current_site_blog_id, 'auth_multisite_settings_access_users_approved', array() );
280	284	$should_update_auth_multisite_settings_access_users_approved = false;
281	285	foreach ( get_super_admins() as $super_admin ) {
		@@ -586,9 +590,9 @@
586	590	if ( is_wp_error( $result ) || 0 === $result ) {
587	591	return $result;
588	592	}
589	593
590		- // If we have a valid user from check_user_access(), log that user in.
	594	+ // If we created a new user in check_user_access(), log that user in.
591	595	if ( get_class( $result ) === 'WP_User' ) {
592	596	$user = $result;
593	597	}
594	598
		@@ -609,12 +613,13 @@
609	613	* @param WP_User $user User to check.
610	614	* @param array $user_emails Array of user's plaintext emails (in case current user doesn't have a WP account).
611	615	* @param array $user_data Array of keys for email, username, first_name, last_name,
612	616	* authenticated_by, google_attributes, cas_attributes, ldap_attributes.
613		- * @return WP_Error|void|WP_User
	617	+ * @return WP_Error|void|null|WP_User
614	618	* WP_Error if there was an error on user creation / adding user to blog.
615	619	* wp_die() if user does not have access.
616		- * WP_User if user has access.
	620	+ * null if user has access (success).
	621	+ * WP_User if user has access and a new account was created for them.
617	622	*/
618	623	private function check_user_access( $user, $user_emails, $user_data = array() ) {
619	624	// Grab plugin settings.
620	625	$auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
		@@ -720,9 +725,9 @@
720	725	// If this externally authenticated user is an existing administrator
721	726	// (administrator in single site mode, or super admin in network mode),
722	727	// and is not in the blocked list, let them in.
723	728	if ( $user && is_super_admin( $user->ID ) ) {
724		- return $user;
	729	+ return;
725	730	}
726	731
727	732	// If this externally authenticated user isn't in the approved list
728	733	// and login access is set to "All authenticated users," or if they were
		@@ -1288,9 +1293,9 @@
1288	1293	// Set the CAS service URL (including the redirect URL for WordPress when it comes back from CAS).
1289	1294	$cas_service_url = site_url( '/wp-login.php?external=cas' );
1290	1295	$login_querystring = array();
1291	1296	if ( isset( $_SERVER['QUERY_STRING'] ) ) {
1292		- parse_str( $_SERVER['QUERY_STRING'], $login_querystring ); // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
	1297	+ parse_str( wp_parse_url( esc_url_raw( wp_unslash( $_SERVER['QUERY_STRING'] ) ), PHP_URL_HOST ), $login_querystring );
1293	1298	}
1294	1299	if ( isset( $login_querystring['redirect_to'] ) ) {
1295	1300	$cas_service_url .= '&redirect_to=' . rawurlencode( $login_querystring['redirect_to'] );
1296	1301	}
		@@ -1938,9 +1943,9 @@
1938	1943	*/
1939	1944	public function auth_public_scripts() {
1940	1945	// Load (and localize) public scripts.
1941	1946	$current_path = ! empty( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : home_url();
1942		- wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
	1947	+ wp_enqueue_script( 'auth_public_scripts', plugins_url( '/js/authorizer-public.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1943	1948	$auth_localized = array(
1944	1949	'wpLoginUrl' => wp_login_url( $current_path ),
1945	1950	'publicWarning' => get_option( 'auth_settings_advanced_public_notice' ),
1946	1951	'anonymousNotice' => $this->get_plugin_option( 'access_redirect_to_message' ),
		@@ -1948,9 +1953,9 @@
1948	1953	);
1949	1954	wp_localize_script( 'auth_public_scripts', 'auth', $auth_localized );
1950	1955
1951	1956	// Load public css.
1952		- wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.8.0' );
	1957	+ wp_register_style( 'authorizer-public-css', plugins_url( 'css/authorizer-public.css', __FILE__ ), array(), '2.3.2' );
1953	1958	wp_enqueue_style( 'authorizer-public-css' );
1954	1959	}
1955	1960
1956	1961
		@@ -1965,12 +1970,12 @@
1965	1970	// Grab plugin settings.
1966	1971	$auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
1967	1972
1968	1973	// Enqueue scripts appearing on wp-login.php.
1969		- wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.8.0' );
	1974	+ wp_enqueue_script( 'auth_login_scripts', plugins_url( '/js/authorizer-login.js', __FILE__ ), array( 'jquery' ), '2.3.2' );
1970	1975
1971	1976	// Enqueue styles appearing on wp-login.php.
1972		- wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.8.0' );
	1977	+ wp_register_style( 'authorizer-login-css', plugins_url( '/css/authorizer-login.css', __FILE__ ), array(), '2.3.2' );
1973	1978	wp_enqueue_style( 'authorizer-login-css' );
1974	1979
1975	1980	/**
1976	1981	* Developers can use the `authorizer_add_branding_option` filter
		@@ -1995,10 +2000,10 @@
1995	2000	if ( ! ( is_array( $branding_option ) && array_key_exists( 'value', $branding_option ) && array_key_exists( 'css_url', $branding_option ) && array_key_exists( 'js_url', $branding_option ) ) ) {
1996	2001	continue;
1997	2002	}
1998	2003	if ( $auth_settings['advanced_branding'] === $branding_option['value'] ) {
1999		- wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.8.0' );
2000		- wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.8.0' );
	2004	+ wp_enqueue_script( 'auth_login_custom_scripts-' . sanitize_title( $branding_option['value'] ), $branding_option['js_url'], array( 'jquery' ), '2.3.2' );
	2005	+ wp_register_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ), $branding_option['css_url'], array(), '2.3.2' );
2001	2006	wp_enqueue_style( 'authorizer-login-custom-css-' . sanitize_title( $branding_option['value'] ) );
2002	2007	}
2003	2008	}
2004	2009
		@@ -2003,9 +2008,9 @@
2003	2008	}
2004	2009
2005	2010	// If we're using Google logins, load those resources.
2006	2011	if ( '1' === $auth_settings['google'] ) {
2007		- wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.8.0' ); ?>
	2012	+ wp_enqueue_script( 'authorizer-login-custom-google', plugins_url( '/js/authorizer-login-custom_google.js', __FILE__ ), array( 'jquery' ), '2.3.2' ); ?>
2008	2013	<meta name="google-signin-clientid" content="<?php echo esc_attr( $auth_settings['google_clientid'] ); ?>" />
2009	2014	<meta name="google-signin-scope" content="email" />
2010	2015	<meta name="google-signin-cookiepolicy" content="single_host_origin" />
2011	2016	<?php
		@@ -2119,9 +2124,9 @@
2119	2124	</span>
2120	2125	</a></p>
2121	2126	<?php endif; ?>
2122	2127
2123		- <?php if ( '1' === $auth_settings['advanced_hide_wp_login'] && isset( $_SERVER['QUERY_STRING'] ) && false === strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) ) : // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput ?>
	2128	+ <?php if ( '1' === $auth_settings['advanced_hide_wp_login'] && isset( $_SERVER['QUERY_STRING'] ) && false === strpos( wp_parse_url( esc_url_raw( wp_unslash( $_SERVER['QUERY_STRING'] ) ), PHP_URL_HOST ), 'external=wordpress' ) ) : ?>
2124	2129	<style type="text/css">
2125	2130	body.login-action-login form {
2126	2131	padding-bottom: 8px;
2127	2132	}
		@@ -2161,9 +2166,9 @@
2161	2166
2162	2167	// Check whether we should redirect to CAS.
2163	2168	if (
2164	2169	isset( $_SERVER['QUERY_STRING'] ) &&
2165		- strpos( $_SERVER['QUERY_STRING'], 'external=wordpress' ) === false && // phpcs:ignore WordPress.VIP.ValidatedSanitizedInput
	2170	+ strpos( wp_parse_url( esc_url_raw( wp_unslash( $_SERVER['QUERY_STRING'] ) ), PHP_URL_HOST ), 'external=wordpress' ) === false &&
2166	2171	array_key_exists( 'cas_auto_login', $auth_settings ) && '1' === $auth_settings['cas_auto_login'] &&
2167	2172	array_key_exists( 'cas', $auth_settings ) && '1' === $auth_settings['cas'] &&
2168	2173	( ! array_key_exists( 'ldap', $auth_settings ) || '1' !== $auth_settings['ldap'] ) &&
2169	2174	( ! array_key_exists( 'google', $auth_settings ) || '1' !== $auth_settings['google'] ) &&
		@@ -2398,9 +2403,9 @@
2398	2403	public function load_options_page() {
2399	2404	wp_enqueue_script(
2400	2405	'authorizer',
2401	2406	plugins_url( 'js/authorizer.js', __FILE__ ),
2402		- array( 'jquery-effects-shake' ), '2.8.0', true
	2407	+ array( 'jquery-effects-shake' ), '2.7.2', true
2403	2408	);
2404	2409	wp_localize_script(
2405	2410	'authorizer', 'authL10n', array(
2406	2411	'baseurl' => get_bloginfo( 'url' ),
		@@ -2484,12 +2489,12 @@
2484	2489	$auth_settings = $this->get_plugin_options( WP_Plugin_Authorizer::SINGLE_CONTEXT, 'allow override' );
2485	2490
2486	2491	if ( '1' === $auth_settings['cas'] ) :
2487	2492	// Check if provided CAS URL is accessible.
2488		- $protocol = in_array( strval( $auth_settings['cas_port'] ), array( '80', '8080' ), true ) ? 'http' : 'https';
2489		- $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
	2493	+ $protocol = in_array( strval( $auth_settings['cas_port'] ), array( '80', '8080' ), true ) ? 'http' : 'https';
	2494	+ $cas_url = $protocol . '://' . $auth_settings['cas_host'] . ':' . $auth_settings['cas_port'] . $auth_settings['cas_path'];
2490	2495	$legacy_cas_url = trailingslashit( $cas_url ) . 'login'; // Check the specific CAS login endpoint (old; some servers don't register a ./login endpoint, use serviceValidate instead).
2491		- $cas_url = trailingslashit( $cas_url ) . 'serviceValidate'; // Check the specific CAS login endpoint.
	2496	+ $cas_url = trailingslashit( $cas_url ) . 'serviceValidate'; // Check the specific CAS login endpoint.
2492	2497	if ( ! $this->url_is_accessible( $cas_url ) && ! $this->url_is_accessible( $legacy_cas_url ) ) :
2493	2498	$authorizer_options_url = 'settings' === $auth_settings['advanced_admin_menu'] ? admin_url( 'options-general.php?page=authorizer' ) : admin_url( '?page=authorizer' );
2494	2499	?>
2495	2500	<div class='notice notice-warning is-dismissible'>
		@@ -6993,20 +6998,9 @@
6993	6998	// Get default role if one isn't specified.
6994	6999	if ( count( $default_role ) < 1 ) {
6995	7000	$default_role = '';
6996	7001	} else {
6997		- // If default role was provided, it came from the invite_user hook, and
6998		- // only contains the role's display name. Here we look up the actual role
6999		- // name to save (and default to no role if the display name isn't found).
7000		- global $wp_roles;
7001		- $default_role_display_name = $default_role['name'];
7002		- $default_role = '';
7003		- foreach ( $wp_roles->role_names as $role_name => $display_name ) {
7004		- if ( $default_role_display_name === $display_name ) {
7005		- $default_role = $role_name;
7006		- break;
7007		- }
7008		- }
	7002	+ $default_role = strtolower( $default_role['name'] );
7009	7003	}
7010	7004
7011	7005	$updated = false;
7012	7006