← All changes | Modules/Auth/AuthModdule.php +63 -23 2.7.7 → 2.10.01 View file →

		@@ -63,12 +63,52 @@
63	63
64	64	// Remove fcom_action and fcom_url_hash from the current url
65	65	$currentUrl = home_url(add_query_arg($_GET, $GLOBALS['wp']->request)); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
66	66	$url = remove_query_arg(['fcom_action', 'fcom_url_hash'], $currentUrl);
67		- wp_redirect($url, 302); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
	67	+ $this->redirectAndExit($url);
	68	+ }
	69	+
	70	+ /**
	71	+ * Send a redirect and stop.
	72	+ *
	73	+ * Extracted only so it can be observed: a bare `exit()` terminates the PHP
	74	+ * process, which in a test run kills the whole suite with no result (see
	75	+ * FIX-PLAN item 22 for the same problem on PortalHandler). A test subclass
	76	+ * overrides this and the two methods below to record what was about to
	77	+ * happen and throw instead. Behaviour in production is unchanged — this is
	78	+ * the original call, moved.
	79	+ *
	80	+ * This one keeps the UNSAFE variant its single caller already used. That
	81	+ * caller builds its target with home_url(), so it is same-host by
	82	+ * construction rather than by validation. Kept as a separate method from
	83	+ * safeRedirectAndExit(), rather than a $safe flag, so the distinction stays
	84	+ * visible to anyone grepping for wp_redirect.
	85	+ */
	86	+ protected function redirectAndExit($url, $status = 302)
	87	+ {
	88	+ wp_redirect($url, $status); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
68	89	exit();
69	90	}
70	91
	92	+ /**
	93	+ * Send a host-confined redirect and stop. See redirectAndExit().
	94	+ */
	95	+ protected function safeRedirectAndExit($url)
	96	+ {
	97	+ wp_safe_redirect($url);
	98	+ exit();
	99	+ }
	100	+
	101	+ /**
	102	+ * Render the headless page and stop. See redirectAndExit().
	103	+ */
	104	+ protected function renderPageAndExit($template, $pageVars)
	105	+ {
	106	+ status_header(200);
	107	+ App::make('view')->render($template, $pageVars);
	108	+ exit(200);
	109	+ }
	110	+
71	111	public function viewAuthPage()
72	112	{
73	113
74	114	add_filter('login_form_defaults', function ($defaults) {
		@@ -98,10 +138,9 @@
98	138	if (!$redirectUrl) {
99	139	$redirectUrl = Helper::baseUrl();
100	140	}
101	141
102		- wp_safe_redirect($redirectUrl);
103		- exit();
	142	+ $this->safeRedirectAndExit($redirectUrl);
104	143	}
105	144
106	145	if ($currentUserId && $inviation) {
107	146	/** @var BaseSpace|null $space */
		@@ -109,10 +148,9 @@
109	148	if ($space) {
110	149	if (Helper::isUserInSpace($currentUserId, $inviation->post_id)) {
111	150	// let's redirect the user to the space
112	151	$redirectUrl = $space->getPermalink();
113		- wp_safe_redirect($redirectUrl);
114		- exit();
	152	+ $this->safeRedirectAndExit($redirectUrl);
115	153	}
116	154
117	155	if (!empty($_REQUEST['auto_accept'])) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
118	156	$redirectUrl = (new InvitationHandler())->handleInvitationLogin(Helper::baseUrl(), get_user_by('ID', $currentUserId), $inviation->message_rendered);
		@@ -118,10 +156,9 @@
118	156	$redirectUrl = (new InvitationHandler())->handleInvitationLogin(Helper::baseUrl(), get_user_by('ID', $currentUserId), $inviation->message_rendered);
119	157	if (is_wp_error($redirectUrl) || !$redirectUrl) {
120	158	$redirectUrl = Helper::baseUrl();
121	159	}
122		- wp_safe_redirect($redirectUrl);
123		- exit();
	160	+ $this->safeRedirectAndExit($redirectUrl);
124	161	}
125	162	}
126	163	}
127	164
		@@ -155,10 +192,9 @@
155	192	}
156	193
157	194	$isFluentAuth = AuthHelper::isFluentAuthAvailable();
158	195	if (!$isFluentAuth && $targetForm == 'reset_password') {
159		- wp_safe_redirect(wp_lostpassword_url(Helper::baseUrl()));
160		- exit();
	196	+ $this->safeRedirectAndExit(wp_lostpassword_url(Helper::baseUrl()));
161	197	}
162	198
163	199	$portalSettings = Helper::generalSettings();
164	200	$titleVar = Arr::get($portalSettings, 'site_title');
		@@ -175,10 +211,9 @@
175	211	$frameData['button_label'] = __('Signup', 'fluent-community');
176	212	if (!$inviation) {
177	213	$customSignupUrl = Arr::get($portalSettings, 'custom_signup_url');
178	214	if ($customSignupUrl) {
179		- wp_safe_redirect($customSignupUrl);
180		- exit();
	215	+ $this->safeRedirectAndExit($customSignupUrl);
181	216	}
182	217	}
183	218	}
184	219
		@@ -191,9 +226,13 @@
191	226	wp_enqueue_script('fluent_auth_scripts', Vite::getStaticSrcUrl('user_registration.js'), [], FLUENT_COMMUNITY_PLUGIN_VERSION, true);
192	227	wp_localize_script('fluent_auth_scripts', 'fluentComRegistration', array(
193	228	'ajax_url' => admin_url('admin-ajax.php'),
194	229	'is_logged_in' => is_user_logged_in(),
195		- 'redirecting_text' => __('Redirecting...', 'fluent-community')
	230	+ 'redirecting_text' => __('Redirecting...', 'fluent-community'),
	231	+ 'i18n' => [
	232	+ 'generic_error' => esc_html__('Something went wrong. Please try again later', 'fluent-community'),
	233	+ 'network_error' => esc_html__('Could not reach the server. Please check your connection and try again.', 'fluent-community'),
	234	+ ]
196	235	));
197	236	}
198	237	}, 10);
199	238
		@@ -289,15 +328,20 @@
289	328	}, 10, 1);
290	329
291	330	add_action('fluent_community/headless/head_early', function ($scope) use ($formSettings) {
292	331	$bannerColors = array_filter(Arr::only($formSettings['banner'], ['title_color', 'text_color', 'background_color']));
293		- $css = Utility::getColorCssVariables(); ?>
	332	+ $css = Utility::getColorCssVariables();
	333	+
	334	+ $sideVars = '';
	335	+ foreach ($bannerColors as $colorKey => $colorValue) {
	336	+ $sideVars .= '--fcom_' . $colorKey . ': ' . $colorValue . ';';
	337	+ }
	338	+ ?>
	339	+ <?php // the auth screen renders with load_wp, which skips headless_page's noindex ?>
	340	+ <meta name="robots" content="noindex, noarchive" />
294	341	<link rel="canonical" href="<?php echo esc_url(Helper::getAuthUrl()); ?>" />
295	342	<style>
296		- .fcom_layout_side {
297		- <?php foreach ($bannerColors as $colorKey => $colorValue): ?> --fcom_ <?php echo esc_html($colorKey); ?>: <?php echo esc_html($colorValue); ?>;
298		- <?php endforeach; ?>
299		- }
	343	+ .fcom_layout_side { <?php echo esc_html($sideVars); ?> }
300	344	<?php echo esc_html($css); ?>
301	345	</style>
302	346	<?php
303	347	});
		@@ -308,11 +352,9 @@
308	352	add_filter('pre_get_document_title', function ($title) use ($frameData) {
309	353	return $frameData['title'];
310	354	}, 9999, 1);
311	355
312		- status_header(200);
313		- App::make('view')->render('headless_page', $pageVars);
314		- exit(200);
	356	+ $this->renderPageAndExit('headless_page', $pageVars);
315	357	}
316	358
317	359	public function handleUserSignup()
318	360	{
		@@ -854,12 +896,10 @@
854	896	add_action('fluent_community/before_registration_form', function ($frameData) {
855	897	if (AuthHelper::isFluentAuthAvailable()) {
856	898	$currentUrl = esc_url(home_url(add_query_arg($_GET, $GLOBALS['wp']->request))); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
857	899
858		- ob_start();
859	900	$titlePrefix = __('Signup with', 'fluent-community');
860		- do_shortcode('[fs_auth_buttons redirect="' . $currentUrl . '" title_prefix="' . $titlePrefix . ' " title=""]');
861		- $html = ob_get_clean();
	901	+ $html = do_shortcode('[fs_auth_buttons redirect="' . $currentUrl . '" title_prefix="' . $titlePrefix . ' " title=""]');
862	902
863	903	if ($html) {
864	904	echo '<div class="fcom_social_auth_wrap">';
865	905	echo $html; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped