Skip to content

Commit f0735f7

Browse files
valendesignsvalendesigns
committed
Merge changes & rework solution
1 parent a06359a commit f0735f7

File tree

5 files changed

+40
-34
lines changed

5 files changed

+40
-34
lines changed

‎tests/wp-includes/rest-api/auth/class-test-wp-rest-key-pair.php

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -69,9 +69,6 @@ public function setUp() {
6969

7070
$this->user_id = $this->factory->user->create( $user_data );
7171
$this->user = get_user_by( 'id', $this->user_id );
72-
73-
// Enforce the expected permalink style
74-
add_filter( 'default_option_permalink_structure', [ $this, 'defaultPermalinkStyle' ], 10, 0 );
7572
}
7673

7774
/**
@@ -85,7 +82,6 @@ public function tearDown() {
8582
$this->user_id = null;
8683
$this->user = null;
8784
unset( $GLOBALS['wp_rest_server'] );
88-
remove_filter( 'default_option_permalink_structure', [ $this, 'defaultPermalinkStyle' ], 10 );
8985
parent::tearDown();
9086
}
9187

@@ -111,16 +107,11 @@ public function test_init() {
111107
* @covers ::get_rest_uri()
112108
*/
113109
public function test_get_rest_uri() {
114-
$this->assertEquals( get_rest_url( null, '/wp/v2/key-pair' ), WP_REST_Key_Pair::get_rest_uri() );
115-
116-
// Multisite can't use plain permalinks
117-
add_filter( 'default_option_permalink_structure', '__return_false', 20, 0 );
118-
$this->assertEquals( get_rest_url( null, '/wp/v2/key-pair' ), WP_REST_Key_Pair::get_rest_uri() );
119-
remove_filter( 'default_option_permalink_structure', '__return_false', 20 );
120-
}
110+
$this->assertEquals( '/index.php?rest_route=/wp/v2/key-pair', WP_REST_Key_Pair::get_rest_uri() );
121111

122-
public function defaultPermalinkStyle() {
123-
return '/%postname%/';
112+
$this->set_permalink_structure( '/%postname%/' );
113+
$this->assertEquals( '/wp-json/wp/v2/key-pair', WP_REST_Key_Pair::get_rest_uri() );
114+
$this->set_permalink_structure( '' );
124115
}
125116

126117
/**
@@ -250,8 +241,12 @@ public function test_profile_update() {
250241
* @since 0.1
251242
*/
252243
public function test_require_token() {
253-
$this->assertTrue( $this->key_pair->require_token( true, '/wp-json/wp/v2/posts', 'POST' ) );
254-
$this->assertTrue( $this->key_pair->require_token( true, '/wp-json/wp/v2/posts', 'DELETE' ) );
244+
$this->assertTrue( $this->key_pair->require_token( true, '/index.php?rest_route=/wp/v2/posts', 'POST' ) );
245+
$this->assertTrue( $this->key_pair->require_token( true, '/index.php?rest_route=/wp/v2/posts', 'DELETE' ) );
246+
247+
$this->assertTrue( $this->key_pair->require_token( true, '/index.php?rest_route=/wp/v2/key-pair', 'GET' ) );
248+
$this->assertFalse( $this->key_pair->require_token( true, '/index.php?rest_route=/wp/v2/key-pair', 'POST' ) );
249+
$this->assertFalse( $this->key_pair->require_token( true, '/index.php?rest_route=/wp/v2/key-pair', 'DELETE' ) );
255250

256251
$this->assertTrue( $this->key_pair->require_token( true, '/wp-json/wp/v2/key-pair', 'GET' ) );
257252
$this->assertFalse( $this->key_pair->require_token( true, '/wp-json/wp/v2/key-pair', 'POST' ) );

‎tests/wp-includes/rest-api/auth/class-test-wp-rest-token.php

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,11 @@ public function test_init() {
7676
* @covers ::get_rest_uri()
7777
*/
7878
public function test_get_rest_uri() {
79+
$this->assertEquals( '/index.php?rest_route=/wp/v2/token', WP_REST_Token::get_rest_uri() );
80+
81+
$this->set_permalink_structure( '/%postname%/' );
7982
$this->assertEquals( '/wp-json/wp/v2/token', WP_REST_Token::get_rest_uri() );
83+
$this->set_permalink_structure( '' );
8084
}
8185

8286
/**
@@ -344,9 +348,8 @@ public function test_authenticate_refresh_token() {
344348
* @since 0.1
345349
*/
346350
public function test_require_token() {
347-
$prefix = rest_get_url_prefix();
348-
$token_uri = sprintf( '/%s/wp/v2/token', $prefix );
349-
$posts_uri = sprintf( '/%s/wp/v2/posts', $prefix );
351+
$token_uri = WP_REST_Token::get_rest_uri();
352+
$posts_uri = sprintf( '/%s/wp/v2/posts', rest_get_url_prefix() );
350353
$user_data = array(
351354
'role' => 'administrator',
352355
'user_login' => 'testuser',

‎wp-admin/js/key-pair.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@
9393

9494
$( document ).on( 'click', '.key-pair-token', function( e ) {
9595
var $parent = $( e.target ).closest( '.new-key-pair' ),
96-
$input = $( 'input[name=new_token_api_secret]' ),
96+
$input = $( 'input[name="new_token_api_secret"]' ),
9797
apiKey = $parent.data( 'api_key' ),
9898
apiSecret = $input.val(),
9999
name = $parent.data( 'name' );

‎wp-includes/rest-api/auth/class-wp-rest-key-pair.php

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,14 @@ public function init() {
7373
* @static
7474
*/
7575
public static function get_rest_uri() {
76-
return get_rest_url( null, sprintf( '/%s/%s', self::_NAMESPACE_, self::_REST_BASE_ ) );
76+
$blog_id = get_current_blog_id();
77+
$prefix = 'index.php?rest_route=';
78+
79+
if ( is_multisite() && get_blog_option( $blog_id, 'permalink_structure' ) || get_option( 'permalink_structure' ) ) {
80+
$prefix = rest_get_url_prefix();
81+
}
82+
83+
return sprintf( '/%s/%s/%s', $prefix, self::_NAMESPACE_, self::_REST_BASE_ );
7784
}
7885

7986
/**
@@ -291,13 +298,8 @@ public function profile_update( $user_id ) {
291298
*/
292299
public function require_token( $require_token, $request_uri, $request_method ) {
293300

294-
// Check both absolute and relative URIs
295-
$is_token_uri =
296-
false !== strpos( $request_uri, self::get_rest_uri() ) &&
297-
false !== strpos( site_url( $request_uri ), self::get_rest_uri() );
298-
299301
// Don't require token authentication to manage key-pairs.
300-
if ( ( 'POST' === $request_method || 'DELETE' === $request_method ) && $is_token_uri ) {
302+
if ( ( 'POST' === $request_method || 'DELETE' === $request_method ) && strpos( $request_uri, sprintf( '/%s/%s', self::_NAMESPACE_, self::_REST_BASE_ ) ) ) {
301303
$require_token = false;
302304
}
303305

@@ -786,10 +788,10 @@ public function template_key_pair_row() {
786788
{{ data.last_ip }}
787789
</td>
788790
<td class="token column-token" data-colname="<?php esc_attr_e( 'Token', 'jwt-auth' ); ?>">
789-
<input type="submit" name="token-key-pair-{{ data.api_key }}" class="button" id=="token-key-pair-{{ data.api_key }}" value="<?php esc_attr_e( 'New Token', 'jwt-auth' ); ?>">
791+
<input type="submit" name="token-key-pair-{{ data.api_key }}" class="button" id="token-key-pair-{{ data.api_key }}" value="<?php esc_attr_e( 'New Token', 'jwt-auth' ); ?>">
790792
</td>
791793
<td class="revoke column-revoke" data-colname="<?php esc_attr_e( 'Revoke', 'jwt-auth' ); ?>">
792-
<input type="submit" name="revoke-key-pair" class="button delete" id=="revoke-key-pair-{{ data.api_key }}" value="<?php esc_attr_e( 'Revoke', 'jwt-auth' ); ?>">
794+
<input type="submit" name="revoke-key-pair" class="button delete" id="revoke-key-pair-{{ data.api_key }}" value="<?php esc_attr_e( 'Revoke', 'jwt-auth' ); ?>">
793795
</td>
794796
</tr>
795797
</script>

‎wp-includes/rest-api/auth/class-wp-rest-token.php

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,14 @@ public function init() {
7979
* @static
8080
*/
8181
public static function get_rest_uri() {
82-
return sprintf( '/%s/%s/%s', rest_get_url_prefix(), self::_NAMESPACE_, self::_REST_BASE_ );
82+
$blog_id = get_current_blog_id();
83+
$prefix = 'index.php?rest_route=';
84+
85+
if ( is_multisite() && get_blog_option( $blog_id, 'permalink_structure' ) || get_option( 'permalink_structure' ) ) {
86+
$prefix = rest_get_url_prefix();
87+
}
88+
89+
return sprintf( '/%s/%s/%s', $prefix, self::_NAMESPACE_, self::_REST_BASE_ );
8390
}
8491

8592
/**
@@ -355,9 +362,8 @@ public function authenticate_refresh_token( $user, WP_REST_Request $request ) {
355362
*/
356363
public function require_token() {
357364
$require_token = true;
358-
$request_uri = isset( $_SERVER['REQUEST_URI'] ) ? $_SERVER['REQUEST_URI'] : false; // phpcs:ignore
359-
$request_method = isset( $_SERVER['REQUEST_METHOD'] ) ? $_SERVER['REQUEST_METHOD'] : false; // phpcs:ignore
360-
$rest_uri = self::get_rest_uri();
365+
$request_uri = isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( $_SERVER['REQUEST_URI'] ) : false;
366+
$request_method = isset( $_SERVER['REQUEST_METHOD'] ) ? sanitize_text_field( $_SERVER['REQUEST_METHOD'] ) : false;
361367

362368
// User is already authenticated.
363369
$user = wp_get_current_user();
@@ -366,7 +372,7 @@ public function require_token() {
366372
}
367373

368374
// Only check REST API requests.
369-
if ( ! strpos( $request_uri, rest_get_url_prefix() ) ) {
375+
if ( ! strpos( $request_uri, rest_get_url_prefix() ) && ! strpos( $request_uri, '?rest_route=' ) ) {
370376
$require_token = false;
371377
}
372378

@@ -376,7 +382,7 @@ public function require_token() {
376382
}
377383

378384
// Don't require authentication to generate a token.
379-
if ( 'POST' === $request_method && $rest_uri === $request_uri ) {
385+
if ( 'POST' === $request_method && strpos( $request_uri, sprintf( '/%s/%s', self::_NAMESPACE_, self::_REST_BASE_ ) ) ) {
380386
$require_token = false;
381387
}
382388

0 commit comments

Comments
 (0)