Skip to content

Commit 93049ba

Browse files
rmccuermccue
committed
Merge branch 'master' into personal-tokens
2 parents ce9d5be + 1747fc7 commit 93049ba

17 files changed

+130
-93
lines changed

‎.travis.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,5 @@ install:
55
- composer install
66
- bash tests/install-tests.sh wordpress_test root '' 127.0.0.1 latest
77
script:
8-
- vendor/bin/phpcs --standard=vendor/humanmade/coding-standards .
8+
- vendor/bin/phpcs --standard=phpcs.ruleset.xml .
99
- phpunit

‎inc/admin/class-listtable.php

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -56,10 +56,10 @@ public function get_columns() {
5656
public function column_cb( $item ) {
5757
?>
5858
<label class="screen-reader-text"
59-
for="cb-select-<?php echo esc_attr( $item->ID ) ?>"><?php esc_html_e( 'Select consumer', 'oauth2' ); ?></label>
59+
for="cb-select-<?php echo esc_attr( $item->ID ); ?>"><?php esc_html_e( 'Select consumer', 'oauth2' ); ?></label>
6060

6161
<input id="cb-select-<?php echo esc_attr( $item->ID ) ?>" type="checkbox"
62-
name="consumers[]" value="<?php echo esc_attr( $item->ID ) ?>"/>
62+
name="consumers[]" value="<?php echo esc_attr( $item->ID ); ?>"/>
6363

6464
<?php
6565
}
@@ -92,7 +92,7 @@ protected function column_name( $item ) {
9292
);
9393
$delete_link = wp_nonce_url( $delete_link, 'rest-oauth2-delete:' . $item->ID );
9494

95-
$actions = [
95+
$actions = [
9696
'edit' => sprintf( '<a href="%s">%s</a>', esc_url( $edit_link ), esc_html__( 'Edit', 'oauth2' ) ),
9797
'delete' => sprintf( '<a href="%s">%s</a>', esc_url( $delete_link ), esc_html__( 'Delete', 'oauth2' ) ),
9898
];
@@ -101,13 +101,14 @@ protected function column_name( $item ) {
101101
if ( current_user_can( $post_type_object->cap->publish_posts ) && $item->post_status !== 'publish' ) {
102102
$publish_link = add_query_arg(
103103
[
104-
'page' => 'rest-oauth2-apps',
104+
'page' => 'rest-oauth2-apps',
105105
'action' => 'approve',
106-
'id' => $item->ID,
106+
'id' => $item->ID,
107107
],
108108
admin_url( 'users.php' )
109109
);
110-
$publish_link = wp_nonce_url( $publish_link, 'rest-oauth2-approve:' . $item->ID );
110+
111+
$publish_link = wp_nonce_url( $publish_link, 'rest-oauth2-approve:' . $item->ID );
111112
$actions['app-approve'] = sprintf(
112113
'<a href="%s">%s</a>',
113114
esc_url( $publish_link ),

‎inc/admin/namespace.php

Lines changed: 33 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ function get_url( $params = [] ) {
4747
* @return string One of 'add', 'edit', 'delete', or '' for default (list)
4848
*/
4949
function get_page_action() {
50-
return isset( $_GET['action'] ) ? $_GET['action'] : '';
50+
return isset( $_GET['action'] ) ? $_GET['action'] : ''; // WPCS: CSRF OK
5151
}
5252

5353
/**
@@ -110,17 +110,18 @@ function render() {
110110
<?php
111111
esc_html_e( 'Registered Applications', 'oauth2' );
112112

113-
if ( current_user_can( 'create_users' ) ) : ?>
113+
if ( current_user_can( 'create_users' ) ) :
114+
?>
114115
<a href="<?php echo esc_url( get_url( 'action=add' ) ) ?>"
115-
class="add-new-h2"><?php echo esc_html_x( 'Add New', 'application', 'oauth2' ); ?></a>
116+
class="add-new-h2"><?php echo esc_html_x( 'Add New', 'application', 'oauth2' ); ?></a>
116117
<?php
117118
endif;
118119
?>
119120
</h2>
120121
<?php
121-
if ( ! empty( $_GET['deleted'] ) ) {
122+
if ( ! empty( $_GET['deleted'] ) ) { // WPCS: CSRF OK
122123
echo '<div id="message" class="updated"><p>' . esc_html__( 'Deleted application.', 'oauth2' ) . '</p></div>';
123-
} elseif ( ! empty( $_GET['approved'] ) ) {
124+
} elseif ( ! empty( $_GET['approved'] ) ) { // WPCS: CSRF OK
124125
echo '<div id="message" class="updated"><p>' . esc_html__( 'Approved application.', 'oauth2' ) . '</p></div>';
125126
}
126127
?>
@@ -203,7 +204,7 @@ function handle_edit_submit( Client $consumer = null ) {
203204

204205
if ( empty( $consumer ) ) {
205206
// Create the consumer
206-
$data = [
207+
$data = [
207208
'name' => $params['name'],
208209
'description' => $params['description'],
209210
'meta' => [
@@ -212,10 +213,11 @@ function handle_edit_submit( Client $consumer = null ) {
212213
],
213214
];
214215

215-
$consumer = $result = Client::create( $data );
216+
$consumer = Client::create( $data );
217+
$result = $consumer;
216218
} else {
217219
// Update the existing consumer post
218-
$data = [
220+
$data = [
219221
'name' => $params['name'],
220222
'description' => $params['description'],
221223
'meta' => [
@@ -264,12 +266,18 @@ function render_edit_page() {
264266
wp_die( __( 'Invalid client ID.', 'oauth2' ) );
265267
}
266268

267-
$form_action = get_url( [ 'action' => 'edit', 'id' => $id ] );
268-
$regenerate_action = get_url( [ 'action' => 'regenerate', 'id' => $id ] );
269+
$form_action = get_url( [
270+
'action' => 'edit',
271+
'id' => $id,
272+
] );
273+
$regenerate_action = get_url( [
274+
'action' => 'regenerate',
275+
'id' => $id,
276+
] );
269277
}
270278

271279
// Handle form submission
272-
$messages = [];
280+
$messages = [];
273281
$form_data = [];
274282
if ( ! empty( $_POST['_wpnonce'] ) ) {
275283
if ( empty( $consumer ) ) {
@@ -278,7 +286,7 @@ function render_edit_page() {
278286
check_admin_referer( 'rest-oauth2-edit-' . $consumer->get_post_id() );
279287
}
280288

281-
$messages = handle_edit_submit( $consumer );
289+
$messages = handle_edit_submit( $consumer );
282290
$form_data = wp_unslash( $_POST );
283291
}
284292
if ( ! empty( $_GET['did_action'] ) ) {
@@ -371,10 +379,12 @@ function render_edit_page() {
371379
<?php echo esc_html_x( 'Private', 'Client type select option', 'oauth2' ); ?>
372380
</label>
373381
<p class="description">
374-
<?php esc_html_e(
382+
<?php
383+
esc_html_e(
375384
'Clients capable of maintaining confidentiality of credentials, such as server-side applications',
376385
'oauth2'
377-
) ?>
386+
);
387+
?>
378388
</p>
379389
</li>
380390
<li>
@@ -389,10 +399,12 @@ function render_edit_page() {
389399
<?php echo esc_html_x( 'Public', 'Client type select option', 'oauth2' ); ?>
390400
</label>
391401
<p class="description">
392-
<?php esc_html_e(
402+
<?php
403+
esc_html_e(
393404
'Clients incapable of keeping credentials secret, such as browser-based applications or desktop and mobile apps',
394405
'oauth2'
395-
) ?>
406+
);
407+
?>
396408
</p>
397409
</li>
398410
</ul>
@@ -552,6 +564,10 @@ function handle_regenerate() {
552564
wp_die( $result->get_error_message() );
553565
}
554566

555-
wp_safe_redirect( get_url( [ 'action' => 'edit', 'id' => $id, 'did_action' => 'regenerate' ] ) );
567+
wp_safe_redirect( get_url( [
568+
'action' => 'edit',
569+
'id' => $id,
570+
'did_action' => 'regenerate',
571+
] ) );
556572
exit;
557573
}

‎inc/admin/profile/namespace.php

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ function bootstrap() {
1616
add_action( 'show_user_profile', __NAMESPACE__ . '\\render_profile_section' );
1717
add_action( 'edit_user_profile', __NAMESPACE__ . '\\render_profile_section' );
1818
add_action( 'all_admin_notices', __NAMESPACE__ . '\\output_profile_messages' );
19-
add_action( 'personal_options_update', __NAMESPACE__ . '\\handle_revocation', 10, 1 );
19+
add_action( 'personal_options_update', __NAMESPACE__ . '\\handle_revocation', 10, 1 );
2020
add_action( 'edit_user_profile_update', __NAMESPACE__ . '\\handle_revocation', 10, 1 );
2121

2222
PersonalTokens\bootstrap();
@@ -85,7 +85,7 @@ function render_token_row( WP_User $user, Access_Token $token ) {
8585
}
8686

8787
$creation_time = $token->get_creation_time();
88-
$details = [
88+
$details = [
8989
sprintf(
9090
/* translators: %1$s: formatted date, %2$s: formatted time */
9191
esc_html__( 'Authorized %1$s at %2$s', 'oauth2' ),
@@ -165,10 +165,10 @@ function output_profile_messages() {
165165
return;
166166
}
167167

168-
if ( ! empty( $_GET['oauth2_revoked'] ) ) {
168+
if ( ! empty( $_GET['oauth2_revoked'] ) ) { // WPCS: CSRF OK
169169
echo '<div id="message" class="updated"><p>' . __( 'Token revoked.', 'oauth2' ) . '</p></div>';
170170
}
171-
if ( ! empty( $_GET['oauth2_revocation_failed'] ) ) {
171+
if ( ! empty( $_GET['oauth2_revocation_failed'] ) ) { // WPCS: CSRF OK
172172
echo '<div id="message" class="updated"><p>' . __( 'Unable to revoke token.', 'oauth2' ) . '</p></div>';
173173
}
174174
}
@@ -197,7 +197,6 @@ function handle_revocation( $user_id ) {
197197

198198
$token = Access_Token::get_by_id( $key );
199199
if ( empty( $token ) ) {
200-
var_dump( $key, $token );
201200
wp_safe_redirect( add_query_arg( 'oauth2_revocation_failed', true, get_edit_user_link( $user_id ) ) );
202201
exit;
203202
}

‎inc/authentication/namespace.php

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -75,11 +75,11 @@ function get_token_from_bearer_header( $header ) {
7575
* @return string|null Token on succes, null on failure.
7676
*/
7777
function get_token_from_request() {
78-
if ( empty( $_GET['access_token'] ) ) {
78+
if ( empty( $_GET['access_token'] ) ) { // WPCS: CSRF OK
7979
return null;
8080
}
8181

82-
$token = $_GET['access_token'];
82+
$token = $_GET['access_token']; // WPCS: CSRF OK
8383
if ( is_string( $token ) ) {
8484
return $token;
8585
}
@@ -116,8 +116,8 @@ function attempt_authentication( $user = null ) {
116116

117117
// Attempt to find the token.
118118
$is_querying_token = true;
119-
$token = Tokens\get_by_id( $token_value );
120-
$client = $token->get_client();
119+
$token = Tokens\get_by_id( $token_value );
120+
$client = $token->get_client();
121121
$is_querying_token = false;
122122

123123
if ( empty( $token ) || empty( $client ) ) {

‎inc/class-client.php

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ public function get_description( $raw = false ) {
7373
// Replicate the_content()'s filters.
7474
global $post;
7575
$current_post = $post;
76-
$the_post = get_post( $this->get_post_id() );
76+
$the_post = get_post( $this->get_post_id() );
7777
if ( $raw ) {
7878
// Skip the filtering and globals.
7979
return $the_post->post_content;
@@ -168,7 +168,7 @@ public function check_redirect_uri( $uri ) {
168168
return false;
169169
}
170170

171-
$supplied = wp_parse_url( $uri );
171+
$supplied = wp_parse_url( $uri );
172172
$all_registered = $this->get_redirect_uris();
173173

174174
foreach ( $all_registered as $registered_uri ) {
@@ -274,7 +274,7 @@ public function issue_token( WP_User $user, $meta = [] ) {
274274
* @return static|null Token if ID is found, null otherwise.
275275
*/
276276
public static function get_by_id( $id ) {
277-
$args = [
277+
$args = [
278278
'post_type' => static::POST_TYPE,
279279
'post_status' => 'publish',
280280
'posts_per_page' => 1,
@@ -367,8 +367,8 @@ public function update( $data ) {
367367
}
368368

369369
$meta = [
370-
static::REDIRECT_URI_KEY => $data['meta']['callback'],
371-
static::TYPE_KEY => $data['meta']['type'],
370+
static::REDIRECT_URI_KEY => $data['meta']['callback'],
371+
static::TYPE_KEY => $data['meta']['type'],
372372
];
373373

374374
foreach ( $meta as $key => $value ) {
@@ -395,8 +395,8 @@ public function delete() {
395395
* @return bool|WP_Error True if client was updated, error otherwise.
396396
*/
397397
public function approve() {
398-
$data = [
399-
'ID' => $this->get_post_id(),
398+
$data = [
399+
'ID' => $this->get_post_id(),
400400
'post_status' => 'publish',
401401
];
402402
$result = wp_update_post( wp_slash( $data ), true );

‎inc/endpoints/class-authorization.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ public function register_hooks() {
1818

1919
public function handle_request() {
2020
// If the form hasn't been submitted, show it.
21-
if ( isset( $_GET['response_type'] ) ) {
22-
$type = wp_unslash( $_GET['response_type'] );
21+
if ( isset( $_GET['response_type'] ) ) { // WPCS: CSRF OK
22+
$type = wp_unslash( $_GET['response_type'] ); // WPCS: CSRF OK
2323
} else {
2424
$type = null;
2525
}

‎inc/endpoints/class-token.php

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -13,22 +13,22 @@
1313
class Token {
1414
public function register_routes() {
1515
register_rest_route( 'oauth2', '/access_token', [
16-
'methods' => 'POST',
16+
'methods' => 'POST',
1717
'callback' => [ $this, 'exchange_token' ],
18-
'args' => [
18+
'args' => [
1919
'grant_type' => [
20-
'required' => true,
21-
'type' => 'string',
20+
'required' => true,
21+
'type' => 'string',
2222
'validate_callback' => [ $this, 'validate_grant_type' ],
2323
],
24-
'client_id' => [
25-
'required' => true,
26-
'type' => 'string',
24+
'client_id' => [
25+
'required' => true,
26+
'type' => 'string',
2727
'validate_callback' => 'rest_validate_request_arg',
2828
],
29-
'code' => [
30-
'required' => true,
31-
'type' => 'string',
29+
'code' => [
30+
'required' => true,
31+
'type' => 'string',
3232
'validate_callback' => 'rest_validate_request_arg',
3333
],
3434
],
@@ -58,9 +58,10 @@ public function exchange_token( WP_REST_Request $request ) {
5858
if ( empty( $client ) ) {
5959
return new WP_Error(
6060
'oauth2.endpoints.token.exchange_token.invalid_client',
61+
/* translators: %s: client ID */
6162
sprintf( __( 'Client ID %s is invalid.', 'oauth2' ), $request['client_id'] ),
6263
[
63-
'status' => WP_Http::BAD_REQUEST,
64+
'status' => WP_Http::BAD_REQUEST,
6465
'client_id' => $request['client_id'],
6566
]
6667
);

‎inc/endpoints/namespace.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ function register() {
1515

1616
// Register convenience URL.
1717
register_rest_route( 'oauth2', '/authorize', [
18-
'methods' => 'GET',
18+
'methods' => 'GET',
1919
'callback' => __NAMESPACE__ . '\\redirect_to_authorize',
2020
]);
2121
}

‎inc/namespace.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ function get_grant_types() {
7373
*/
7474
function register_grant_types( $types ) {
7575
$types['authorization_code'] = new Types\Authorization_Code();
76-
$types['implicit'] = new Types\Implicit();
76+
$types['implicit'] = new Types\Implicit();
7777

7878
return $types;
7979
}
@@ -88,9 +88,9 @@ function register_in_index( WP_REST_Response $response ) {
8888
$data = $response->get_data();
8989

9090
$data['authentication']['oauth2'] = [
91-
'endpoints' => [
91+
'endpoints' => [
9292
'authorization' => get_authorization_url(),
93-
'token' => get_token_url(),
93+
'token' => get_token_url(),
9494
],
9595
'grant_types' => array_keys( get_grant_types() ),
9696
];

0 commit comments

Comments
 (0)