Skip to content

Commit 855cfab

Browse files
valendesignsvalendesigns
authored
Merge pull request #12 from WP-API/auth-fix
Allow for both plain and pretty permalink structures
2 parents 989f2f8 + e1e7e88 commit 855cfab

File tree

5 files changed

+40
-16
lines changed

5 files changed

+40
-16
lines changed

‎tests/wp-includes/rest-api/auth/class-test-wp-rest-key-pair.php

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,11 @@ public function test_init() {
107107
* @covers ::get_rest_uri()
108108
*/
109109
public function test_get_rest_uri() {
110+
$this->assertEquals( '/index.php?rest_route=/wp/v2/key-pair', WP_REST_Key_Pair::get_rest_uri() );
111+
112+
$this->set_permalink_structure( '/%postname%/' );
110113
$this->assertEquals( '/wp-json/wp/v2/key-pair', WP_REST_Key_Pair::get_rest_uri() );
114+
$this->set_permalink_structure( '' );
111115
}
112116

113117
/**
@@ -237,8 +241,12 @@ public function test_profile_update() {
237241
* @since 0.1
238242
*/
239243
public function test_require_token() {
240-
$this->assertTrue( $this->key_pair->require_token( true, '/wp-json/wp/v2/posts', 'POST' ) );
241-
$this->assertTrue( $this->key_pair->require_token( true, '/wp-json/wp/v2/posts', 'DELETE' ) );
244+
$this->assertTrue( $this->key_pair->require_token( true, '/index.php?rest_route=/wp/v2/posts', 'POST' ) );
245+
$this->assertTrue( $this->key_pair->require_token( true, '/index.php?rest_route=/wp/v2/posts', 'DELETE' ) );
246+
247+
$this->assertTrue( $this->key_pair->require_token( true, '/index.php?rest_route=/wp/v2/key-pair', 'GET' ) );
248+
$this->assertFalse( $this->key_pair->require_token( true, '/index.php?rest_route=/wp/v2/key-pair', 'POST' ) );
249+
$this->assertFalse( $this->key_pair->require_token( true, '/index.php?rest_route=/wp/v2/key-pair', 'DELETE' ) );
242250

243251
$this->assertTrue( $this->key_pair->require_token( true, '/wp-json/wp/v2/key-pair', 'GET' ) );
244252
$this->assertFalse( $this->key_pair->require_token( true, '/wp-json/wp/v2/key-pair', 'POST' ) );

‎tests/wp-includes/rest-api/auth/class-test-wp-rest-token.php

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,11 @@ public function test_init() {
7676
* @covers ::get_rest_uri()
7777
*/
7878
public function test_get_rest_uri() {
79+
$this->assertEquals( '/index.php?rest_route=/wp/v2/token', WP_REST_Token::get_rest_uri() );
80+
81+
$this->set_permalink_structure( '/%postname%/' );
7982
$this->assertEquals( '/wp-json/wp/v2/token', WP_REST_Token::get_rest_uri() );
83+
$this->set_permalink_structure( '' );
8084
}
8185

8286
/**
@@ -344,9 +348,8 @@ public function test_authenticate_refresh_token() {
344348
* @since 0.1
345349
*/
346350
public function test_require_token() {
347-
$prefix = rest_get_url_prefix();
348-
$token_uri = sprintf( '/%s/wp/v2/token', $prefix );
349-
$posts_uri = sprintf( '/%s/wp/v2/posts', $prefix );
351+
$token_uri = WP_REST_Token::get_rest_uri();
352+
$posts_uri = sprintf( '/%s/wp/v2/posts', rest_get_url_prefix() );
350353
$user_data = array(
351354
'role' => 'administrator',
352355
'user_login' => 'testuser',

‎wp-admin/js/key-pair.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@
9393

9494
$( document ).on( 'click', '.key-pair-token', function( e ) {
9595
var $parent = $( e.target ).closest( '.new-key-pair' ),
96-
$input = $( 'input[name=new_token_api_secret]' ),
96+
$input = $( 'input[name="new_token_api_secret"]' ),
9797
apiKey = $parent.data( 'api_key' ),
9898
apiSecret = $input.val(),
9999
name = $parent.data( 'name' );

‎wp-includes/rest-api/auth/class-wp-rest-key-pair.php

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,14 @@ public function init() {
7373
* @static
7474
*/
7575
public static function get_rest_uri() {
76-
return sprintf( '/%s/%s/%s', rest_get_url_prefix(), self::_NAMESPACE_, self::_REST_BASE_ );
76+
$blog_id = get_current_blog_id();
77+
$prefix = 'index.php?rest_route=';
78+
79+
if ( is_multisite() && get_blog_option( $blog_id, 'permalink_structure' ) || get_option( 'permalink_structure' ) ) {
80+
$prefix = rest_get_url_prefix();
81+
}
82+
83+
return sprintf( '/%s/%s/%s', $prefix, self::_NAMESPACE_, self::_REST_BASE_ );
7784
}
7885

7986
/**
@@ -292,7 +299,7 @@ public function profile_update( $user_id ) {
292299
public function require_token( $require_token, $request_uri, $request_method ) {
293300

294301
// Don't require token authentication to manage key-pairs.
295-
if ( ( 'POST' === $request_method || 'DELETE' === $request_method ) && false !== strpos( $request_uri, self::get_rest_uri() ) ) {
302+
if ( ( 'POST' === $request_method || 'DELETE' === $request_method ) && strpos( $request_uri, sprintf( '/%s/%s', self::_NAMESPACE_, self::_REST_BASE_ ) ) ) {
296303
$require_token = false;
297304
}
298305

@@ -781,10 +788,10 @@ public function template_key_pair_row() {
781788
{{ data.last_ip }}
782789
</td>
783790
<td class="token column-token" data-colname="<?php esc_attr_e( 'Token', 'jwt-auth' ); ?>">
784-
<input type="submit" name="token-key-pair-{{ data.api_key }}" class="button" id=="token-key-pair-{{ data.api_key }}" value="<?php esc_attr_e( 'New Token', 'jwt-auth' ); ?>">
791+
<input type="submit" name="token-key-pair-{{ data.api_key }}" class="button" id="token-key-pair-{{ data.api_key }}" value="<?php esc_attr_e( 'New Token', 'jwt-auth' ); ?>">
785792
</td>
786793
<td class="revoke column-revoke" data-colname="<?php esc_attr_e( 'Revoke', 'jwt-auth' ); ?>">
787-
<input type="submit" name="revoke-key-pair" class="button delete" id=="revoke-key-pair-{{ data.api_key }}" value="<?php esc_attr_e( 'Revoke', 'jwt-auth' ); ?>">
794+
<input type="submit" name="revoke-key-pair" class="button delete" id="revoke-key-pair-{{ data.api_key }}" value="<?php esc_attr_e( 'Revoke', 'jwt-auth' ); ?>">
788795
</td>
789796
</tr>
790797
</script>

‎wp-includes/rest-api/auth/class-wp-rest-token.php

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,14 @@ public function init() {
7979
* @static
8080
*/
8181
public static function get_rest_uri() {
82-
return sprintf( '/%s/%s/%s', rest_get_url_prefix(), self::_NAMESPACE_, self::_REST_BASE_ );
82+
$blog_id = get_current_blog_id();
83+
$prefix = 'index.php?rest_route=';
84+
85+
if ( is_multisite() && get_blog_option( $blog_id, 'permalink_structure' ) || get_option( 'permalink_structure' ) ) {
86+
$prefix = rest_get_url_prefix();
87+
}
88+
89+
return sprintf( '/%s/%s/%s', $prefix, self::_NAMESPACE_, self::_REST_BASE_ );
8390
}
8491

8592
/**
@@ -359,9 +366,8 @@ public function authenticate_refresh_token( $user, WP_REST_Request $request ) {
359366
*/
360367
public function require_token() {
361368
$require_token = true;
362-
$request_uri = isset( $_SERVER['REQUEST_URI'] ) ? $_SERVER['REQUEST_URI'] : false; // phpcs:ignore
363-
$request_method = isset( $_SERVER['REQUEST_METHOD'] ) ? $_SERVER['REQUEST_METHOD'] : false; // phpcs:ignore
364-
$rest_uri = self::get_rest_uri();
369+
$request_uri = isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( $_SERVER['REQUEST_URI'] ) : false;
370+
$request_method = isset( $_SERVER['REQUEST_METHOD'] ) ? sanitize_text_field( $_SERVER['REQUEST_METHOD'] ) : false;
365371

366372
// User is already authenticated.
367373
$user = wp_get_current_user();
@@ -370,7 +376,7 @@ public function require_token() {
370376
}
371377

372378
// Only check REST API requests.
373-
if ( ! strpos( $request_uri, rest_get_url_prefix() ) ) {
379+
if ( ! strpos( $request_uri, rest_get_url_prefix() ) && ! strpos( $request_uri, '?rest_route=' ) ) {
374380
$require_token = false;
375381
}
376382

@@ -386,7 +392,7 @@ public function require_token() {
386392
}
387393

388394
// Don't require authentication to generate a token.
389-
if ( 'POST' === $request_method && $rest_uri === $request_uri ) {
395+
if ( 'POST' === $request_method && strpos( $request_uri, sprintf( '/%s/%s', self::_NAMESPACE_, self::_REST_BASE_ ) ) ) {
390396
$require_token = false;
391397
}
392398

0 commit comments

Comments
 (0)