SSO: Validate the wpcom_user_id

Author: kraftbj

modules/sso.php

@@ -700,6 +700,15 @@ function handle_login() {
 			$user_found_with = 'external_user_id';
 			$user = get_user_by( 'id', intval( $user_data->external_user_id ) );
 			if ( $user ) {
+				$expected_id = get_user_meta( $user->ID, 'wpcom_user_id', true );
+				if ( $expected_id && $expected_id != $user_data->ID ) { // phpcs:ignore WordPress.PHP.StrictComparisons.LooseComparison
+					$error = new WP_Error( 'expected_wpcom_user', __( 'Something got a little mixed up and an unexpected WordPress.com user logged in.', 'jetpack' ) );
+
+					/** This filter is documented in core/src/wp-includes/pluggable.php */
+					do_action( 'wp_login_failed', $user_data->login, $error );
+					add_filter( 'login_message', array( 'Jetpack_SSO_Notices', 'error_invalid_response_data' ) ); // @todo Need to have a better notice. This is only for the sake of testing the validation.
+					return;
+				}
 				update_user_meta( $user->ID, 'wpcom_user_id', $user_data->ID );
 			}
 		}