Fixed the nonce check

Author: almirbi

inc/authentication/namespace.php

@@ -75,7 +75,7 @@ function attempt_authentication( $user = null ) {
 			array(
 				'status' => WP_Http::FORBIDDEN,
 				'token' => $token_value,
-			),
+			)
 		);
 	}
 

inc/endpoints/class-authorization.php

@@ -13,7 +13,6 @@ class Authorization {
 	 */
 	public function register_hooks() {
 		add_action( 'login_form_' . static::LOGIN_ACTION, array( $this, 'handle_request' ) );
-		add_action( 'oauth2_authorize_form', array( $this, 'render_page_fields' ) );
 	}
 
 	public function handle_request() {
@@ -22,7 +21,7 @@ public function handle_request() {
 
 		switch ( $type ) {
 			case 'code':
-				$handler = new Types\Authorization_Code();
+				$handler = new Types\AuthorizationCode();
 				break;
 
 			case 'token':
@@ -42,8 +41,4 @@ public function handle_request() {
 			wp_die( $result->get_error_message() );
 		}
 	}
-
-	public function render_page_fields() {
-		wp_nonce_field( 'json_oauth2_authorize' );
-	}
 }

inc/tokens/class-token.php

@@ -29,5 +29,5 @@ public function is_valid() {
 	public function get_meta_key() {
 		return static::get_meta_prefix() . $this->get_key();
 	}
-	public function to_meta_value();
+	public abstract function to_meta_value();
 }

inc/types/class-base.php

@@ -46,7 +46,6 @@ public function handle_authorisation() {
 			return $this->render_form( $client );
 		}
 
-
 		// Check nonce.
 		$nonce = wp_unslash( $_POST['_wpnonce'] );
 		if ( ! wp_verify_nonce( $nonce, $this->get_nonce_action( $client ) ) ) {
@@ -56,8 +55,6 @@ public function handle_authorisation() {
 			);
 		}
 
-
-
 		$submit = wp_unslash( $_POST['wp-submit'] );
 		if ( empty( $submit ) ) {
 			return new WP_Error();
@@ -118,6 +115,7 @@ public function render_form( Client $client ) {
 	 * @param Client $client Client to generate nonce for.
 	 */
 	protected function get_nonce_action( Client $client ) {
-		return sprintf( 'oauth2_authorize:%s', $client->get_post_id() );
+		// return sprintf( 'oauth2_authorize:%s', $client->get_post_id() );
+		return 'json_oauth2_authorize';
 	}
 }

lib/class-wp-rest-oauth2-ui.php

@@ -28,7 +28,6 @@ class WP_REST_OAuth2_UI {
 	 */
 	public function register_hooks() {
 		add_action( 'login_form_oauth2_authorize', array( $this, 'handle_request' ) );
-		// add_action( 'oauth2_authorize_form', array( $this, 'page_fields' ) );
 	}
 
 	/**
@@ -59,55 +58,6 @@ public function render_page() {
 		$auth_code->handle_authorisation();
 	}
 
-	/**
-	 * Output required hidden fields
-	 *
-	 * Outputs the required hidden fields for the authorization page, including
-	 * nonce field.
-	 */
-	public function page_fields() {
-		wp_nonce_field( sprintf( 'oauth2_authorize:%s', $this->client->get_post_id() ) );
-	}
-
-	/**
-	 * Handle redirecting the user after authorization
-	 *
-	 * @param string $verifier Verification code
-	 * @return null|WP_Error Null on success, error otherwise
-	 */
-	/*public function handle_callback_redirect( $verifier ) {
-		if ( empty( $this->token['callback'] ) || $this->token['callback'] === 'oob' ) {
-			// No callback registered, display verification code to the user
-			login_header( __( 'Access Token', 'rest_oauth1' ) );
-			echo '<p>' . sprintf( __( 'Your verification token is <code>%s</code>', 'rest_oauth1' ), $verifier ) . '</p>';
-			login_footer();
-
-			return null;
-		}
-
-		$callback = $this->token['callback'];
-
-		// Ensure the URL is safe to access
-		$authenticator = new WP_REST_OAuth1();
-		if ( ! $authenticator->check_callback( $callback, $this->token['consumer'] ) ) {
-			return new WP_Error( 'json_oauth1_invalid_callback', __( 'The callback URL is invalid', 'rest_oauth1' ), array( 'status' => 400 ) );
-		}
-
-		$args = array(
-			'oauth_token' => $this->token['key'],
-			'oauth_verifier' => $verifier,
-			'wp_scope' => '*',
-		);
-		$args = apply_filters( 'json_oauth2_callback_args', $args, $this->token );
-		$args = urlencode_deep( $args );
-		$callback = add_query_arg( $args, $callback );
-
-		// Offsite, so skip safety check
-		wp_redirect( $callback );
-
-		return null;
-	}*/
-
 	/**
 	 * Display an error using login page wrapper
 	 *

theme/oauth2-authorize.php

@@ -76,7 +76,7 @@
 	 * Fires inside the lostpassword <form> tags.
 	 */
 	do_action( 'oauth2_authorize_form', $client );
-	wp_nonce_field( 'oauth2_authorize' );
+	wp_nonce_field( 'json_oauth2_authorize' );
 	?>
 
 	<p class="submit">