Skip to content

Commit 80644be

Browse files
almirbialmirbi
committed
Fixed up bootstraping; Added OAuth2 page UI for wp-login.php
1 parent f7557f6 commit 80644be

File tree

5 files changed

+208
-7
lines changed

5 files changed

+208
-7
lines changed

‎.gitignore

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,5 @@ _book
1313
# eBook build output
1414
*.epub
1515
*.mobi
16-
*.pdf
16+
*.pdf
17+
.idea

‎inc/types/class-base.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ public function handle_authorisation() {
4747

4848
// Check nonce.
4949
$nonce = wp_unslash( $_POST['_wpnonce'] );
50-
if ( ! wp_verify_nonce( $nonce, $this->get_nonce_action( $client ) ) {
50+
if ( ! wp_verify_nonce( $nonce, $this->get_nonce_action( $client ) ) ) {
5151
return new WP_Error(
5252
'oauth2.types.authorization_code.handle_authorisation.invalid_nonce',
5353
__( 'Invalid nonce.', 'oauth2' )

‎lib/class-wp-rest-oauth2-ui.php

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
<?php
2+
/**
3+
* Authorization page handler
4+
*
5+
* Takes care of UI and related elements for the authorization step of OAuth.
6+
*
7+
* @package WordPress
8+
* @subpackage JSON API
9+
*/
10+
11+
class WP_REST_OAuth2_UI {
12+
/**
13+
* Request token for the current authorization request
14+
*
15+
* @var array
16+
*/
17+
protected $token;
18+
19+
/**
20+
* Consumer post object for the current authorization request
21+
*
22+
* @var WP_Post
23+
*/
24+
protected $consumer;
25+
26+
/**
27+
* Register required actions and filters
28+
*/
29+
public function register_hooks() {
30+
add_action( 'login_form_oauth2_authorize', array( $this, 'handle_request' ) );
31+
// add_action( 'oauth2_authorize_form', array( $this, 'page_fields' ) );
32+
}
33+
34+
/**
35+
* Handle request to authorization page
36+
*
37+
* Handles response from {@see render_page}, then exits to avoid output from
38+
* default wp-login handlers.
39+
*/
40+
public function handle_request() {
41+
if ( ! is_user_logged_in() ) {
42+
wp_safe_redirect( wp_login_url( $_SERVER['REQUEST_URI'] ) );
43+
exit;
44+
}
45+
46+
$response = $this->render_page();
47+
if ( is_wp_error( $response ) ) {
48+
$this->display_error( $response );
49+
}
50+
exit;
51+
}
52+
53+
/**
54+
* Render authorization page
55+
*
56+
* @return null|WP_Error Null on success, error otherwise
57+
*/
58+
public function render_page() {
59+
// Check required fields
60+
/*if ( empty( $_REQUEST['response_type'] ) ) {
61+
return new WP_Error( 'json_oauth2_missing_param', sprintf( __( 'Missing parameter %s', 'rest_oauth2' ), 'response_type' ), array( 'status' => 400 ) );
62+
}
63+
64+
if ( empty( $_REQUEST['client_id'] ) ) {
65+
return new WP_Error( 'json_oauth2_missing_param', sprintf( __( 'Missing parameter %s', 'rest_oauth2' ), 'client_id' ), array( 'status' => 400 ) );
66+
}*/
67+
68+
/*// Set up fields
69+
$token_key = wp_unslash( $_REQUEST['oauth_token'] );
70+
$scope = '*';
71+
if ( ! empty( $_REQUEST['wp_scope'] ) ) {
72+
$scope = wp_unslash( $_REQUEST['wp_scope'] );
73+
}*/
74+
75+
// $authenticator = new WP_REST_OAuth1();
76+
// $errors = array();
77+
// $this->token = $authenticator->get_request_token( $token_key );
78+
/*if ( is_wp_error( $this->token ) ) {
79+
return $this->token;
80+
}
81+
82+
if ( ! empty( $_REQUEST['oauth_callback'] ) ) {
83+
$resp = $authenticator->set_request_token_callback( $this->token['key'], $_REQUEST['oauth_callback'] );
84+
if ( is_wp_error( $resp ) ) {
85+
return $resp;
86+
}
87+
}
88+
89+
if ( $this->token['authorized'] === true ) {
90+
return $this->handle_callback_redirect( $this->token['verifier'] );
91+
}
92+
93+
// Fetch consumer
94+
$this->consumer = $consumer = get_post( $this->token['consumer'] );*/
95+
96+
/*if ( ! empty( $_POST['wp-submit'] ) ) {
97+
check_admin_referer( 'json_oauth2_authorize' );
98+
99+
switch ( $_POST['wp-submit'] ) {
100+
case 'authorize':
101+
$verifier = $authenticator->authorize_request_token( $this->token['key'] );
102+
if ( is_wp_error( $verifier ) ) {
103+
return $verifier;
104+
}
105+
106+
return $this->handle_callback_redirect( $verifier );
107+
108+
case 'cancel':
109+
exit;
110+
111+
default:
112+
return new WP_Error( 'json_oauth1_invalid_action', __( 'Invalid authorization action', 'rest_oauth1' ), array( 'status' => 400 ) );
113+
}
114+
}*/
115+
116+
$file = locate_template( 'oauth2-authorize.php' );
117+
if ( empty( $file ) ) {
118+
$file = dirname( dirname( __FILE__ ) ) . '/theme/oauth2-authorize.php';
119+
}
120+
121+
include $file;
122+
}
123+
124+
/**
125+
* Output required hidden fields
126+
*
127+
* Outputs the required hidden fields for the authorization page, including
128+
* nonce field.
129+
*/
130+
public function page_fields() {
131+
echo '<input type="hidden" name="consumer" value="' . absint( $this->consumer->ID ) . '" />';
132+
echo '<input type="hidden" name="oauth_token" value="' . esc_attr( $this->token['key'] ) . '" />';
133+
wp_nonce_field( 'json_oauth2_authorize' );
134+
}
135+
136+
/**
137+
* Handle redirecting the user after authorization
138+
*
139+
* @param string $verifier Verification code
140+
* @return null|WP_Error Null on success, error otherwise
141+
*/
142+
/*public function handle_callback_redirect( $verifier ) {
143+
if ( empty( $this->token['callback'] ) || $this->token['callback'] === 'oob' ) {
144+
// No callback registered, display verification code to the user
145+
login_header( __( 'Access Token', 'rest_oauth1' ) );
146+
echo '<p>' . sprintf( __( 'Your verification token is <code>%s</code>', 'rest_oauth1' ), $verifier ) . '</p>';
147+
login_footer();
148+
149+
return null;
150+
}
151+
152+
$callback = $this->token['callback'];
153+
154+
// Ensure the URL is safe to access
155+
$authenticator = new WP_REST_OAuth1();
156+
if ( ! $authenticator->check_callback( $callback, $this->token['consumer'] ) ) {
157+
return new WP_Error( 'json_oauth1_invalid_callback', __( 'The callback URL is invalid', 'rest_oauth1' ), array( 'status' => 400 ) );
158+
}
159+
160+
$args = array(
161+
'oauth_token' => $this->token['key'],
162+
'oauth_verifier' => $verifier,
163+
'wp_scope' => '*',
164+
);
165+
$args = apply_filters( 'json_oauth2_callback_args', $args, $this->token );
166+
$args = urlencode_deep( $args );
167+
$callback = add_query_arg( $args, $callback );
168+
169+
// Offsite, so skip safety check
170+
wp_redirect( $callback );
171+
172+
return null;
173+
}*/
174+
175+
/**
176+
* Display an error using login page wrapper
177+
*
178+
* @param WP_Error $error Error object
179+
*/
180+
public function display_error( WP_Error $error ) {
181+
login_header( __( 'Error', 'rest_oauth2' ), '', $error );
182+
login_footer();
183+
}
184+
}

‎plugin.php

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,30 @@
1414
function bootstrap() {
1515
load();
1616

17-
add_filter( 'determine_current_user', __NAMESPACE__ . '\\attempt_authentication' );
17+
// add_filter( 'determine_current_user', __NAMESPACE__ . '\\attempt_authentication' );
1818
add_filter( 'oauth2.grant_types', __NAMESPACE__ . '\\register_grant_types', 0 );
19+
add_action( 'init', __NAMESPACE__ . '\\rest_oauth2_load_authorize_page' );
1920
}
2021

2122
function load() {
2223
require __DIR__ . '/inc/class-client.php';
2324
require __DIR__ . '/inc/class-scopes.php';
2425
require __DIR__ . '/inc/types/class-type.php';
26+
require __DIR__ . '/inc/types/class-base.php';
2527
require __DIR__ . '/inc/types/class-authorization-code.php';
26-
require __DIR__ . '/inc/types/class-implicit.php';
28+
// require __DIR__ . '/inc/types/class-implicit.php';
29+
require __DIR__ . '/lib/class-wp-rest-oauth2-ui.php';
30+
}
31+
32+
/**
33+
* Register the authorization page
34+
*
35+
* Alas, login_init is too late to register pages, as the action is already
36+
* sanitized before this.
37+
*/
38+
function rest_oauth2_load_authorize_page() {
39+
$authorizer = new \WP_REST_OAuth2_UI();
40+
$authorizer->register_hooks();
2741
}
2842

2943
/**
@@ -112,3 +126,5 @@ function get_token_url() {
112126
*/
113127
return apply_filters( 'oauth2.get_token_url', $url );
114128
}
129+
130+
bootstrap();

‎theme/oauth1-authorize.php renamed to ‎theme/oauth2-authorize.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@
5454

5555
<form name="oauth1_authorize_form" id="oauth1_authorize_form" action="<?php echo esc_url( $url ); ?>" method="post">
5656

57-
<h2 class="login-title"><?php echo esc_html( sprintf( __('Connect %1$s'), $client->get_name() ) ) ?></h2>
57+
<h2 class="login-title"><?php echo esc_html( sprintf( __('Connect %1$s'), "Awesome Client" ) ) ?></h2>
5858

5959
<div class="login-info">
6060

@@ -64,7 +64,7 @@
6464
printf(
6565
__( 'Howdy <strong>%1$s</strong>,<br/> "%2$s" would like to connect to %3$s.', 'oauth2' ),
6666
$current_user->user_login,
67-
$client->get_name(),
67+
"Awesome Client",
6868
get_bloginfo( 'name' )
6969
)
7070
?></p>
@@ -76,7 +76,7 @@
7676
* Fires inside the lostpassword <form> tags.
7777
*/
7878
do_action( 'oauth2_authorize_form', $client );
79-
wp_nonce_field( sprintf( 'oauth2_authorize:%s', $client->get_key() ) );
79+
wp_nonce_field( sprintf( 'oauth2_authorize:%s', "Aajaskdjalskdjkl" ) );
8080
?>
8181

8282
<p class="submit">

0 commit comments

Comments
 (0)