Skip to content

Commit 5ad796d

Browse files
glenaglena
authored
Merge pull request #277 from auth0/fix-edit-profile
Fix edit profile
2 parents c65dd05 + 9d9f850 commit 5ad796d

13 files changed

+67
-26
lines changed

‎lib/WP_Auth0_Api_Operations.php‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,6 @@ public function create_wordpress_connection( $app_token, $migration_enabled, $pa
162162
*/
163163
public function social_validation( $app_token, $old_options, $input, $strategy, $connection_options ) {
164164
$domain = $this->a0_options->get( 'domain' );
165-
$secret = $this->a0_options->get( 'client_secret' );
166165
$client_id = $this->a0_options->get( 'client_id' );
167166

168167
$main_key = "social_$strategy";

‎lib/WP_Auth0_Configure_JWTAUTH.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ public function setupjwt() {
5353
if ( self::is_jwt_auth_enabled() ) {
5454
JWT_AUTH_Options::set( 'aud', $this->a0_options->get( 'client_id' ) );
5555
JWT_AUTH_Options::set( 'secret', $this->a0_options->get( 'client_secret' ) );
56-
JWT_AUTH_Options::set( 'secret_base64_encoded', true );
56+
JWT_AUTH_Options::set( 'secret_base64_encoded', $this->a0_options->get( 'client_secret_b64_encoded' ) );
5757
JWT_AUTH_Options::set( 'override_user_repo', 'WP_Auth0_UsersRepo' );
5858
$this->a0_options->set( 'jwt_auth_integration', true );
5959
}
@@ -75,7 +75,7 @@ public static function is_jwt_configured() {
7575
return (
7676
JWT_AUTH_Options::get( 'aud' ) === $options->get( 'client_id' ) &&
7777
JWT_AUTH_Options::get( 'secret' ) === $options->get( 'client_secret' ) &&
78-
JWT_AUTH_Options::get( 'secret_base64_encoded' ) &&
78+
JWT_AUTH_Options::get( 'secret_base64_encoded' ) === $options->get( 'client_secret_b64_encoded' ) &&
7979
$options->get( 'jwt_auth_integration' ) &&
8080
JWT_AUTH_Options::get( 'jwt_attribute' ) === 'sub'
8181
);

‎lib/WP_Auth0_EditProfile.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -268,8 +268,8 @@ public function override_email_update() {
268268
$errors = new WP_Error();
269269
}
270270

271-
$current_user = get_currentauth0user();
272-
$user_profile = $current_user->auth0_obj;
271+
$current_user = wp_get_current_user();
272+
$user_profile = get_currentauth0userinfo();
273273

274274
$app_token = $this->a0_options->get( 'auth0_app_token' );;
275275

‎lib/WP_Auth0_Lock10_Options.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -205,7 +205,7 @@ public function get_sso_options() {
205205
if ( $this->get_auth0_implicit_workflow() ) {
206206
$options["callbackOnLocationHash"] = true;
207207
$options["callbackURL"] = $this->get_implicit_callback_url();
208-
$options["scope"] .= "name email picture nickname email_verified identities";
208+
$options["scope"] .= "name email picture nickname email_verified";
209209
} else {
210210
$options["callbackOnLocationHash"] = false;
211211
$options["callbackURL"] = $this->get_code_callback_url();

‎lib/WP_Auth0_LoginManager.php‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -240,8 +240,18 @@ public function redirect_login() {
240240

241241
if ( !isset( $data->id_token ) ) {
242242
$data->id_token = null;
243+
$response = WP_Auth0_Api_Client::get_user_info( $domain, $data->access_token );
244+
} else {
245+
// grab the user ID from the id_token to call get_user
246+
$decodedToken = JWT::decode( $data->id_token, $this->a0_options->get_client_secret_as_key(), array( 'HS256' ) );
247+
248+
// validate that this JWT was made for us
249+
if ( $this->a0_options->get( 'client_id' ) !== $decodedToken->aud ) {
250+
throw new Exception( 'This token is not intended for us.' );
251+
}
252+
253+
$response = WP_Auth0_Api_Client::get_user( $domain, $data->id_token, $decodedToken->sub );
243254
}
244-
$response = WP_Auth0_Api_Client::get_user_info( $domain, $data->access_token );
245255

246256
if ( $response instanceof WP_Error ) {
247257
WP_Auth0_ErrorManager::insert_auth0_error( 'init_auth0_userinfo', $response );
@@ -302,9 +312,7 @@ public function implicit_login() {
302312
$token = $_POST['token'];
303313
$stateFromGet = json_decode( base64_decode( $_POST['state'] ) );
304314

305-
$secret = $this->a0_options->get( 'client_secret' );
306-
307-
$secret = JWT::urlsafeB64Decode( $secret );
315+
$secret = $this->a0_options->get_client_secret_as_key();
308316

309317
try {
310318
// Decode the user
@@ -498,9 +506,7 @@ public function login_with_credentials( $username, $password, $connection="Usern
498506

499507
$response = WP_Auth0_Api_Client::ro( $domain, $client_id, $username, $password, $connection, 'openid name email nickname email_verified identities' );
500508

501-
$secret = $this->a0_options->get( 'client_secret' );
502-
503-
$secret = JWT::urlsafeB64Decode( $secret );
509+
$secret = $this->a0_options->get_client_secret_as_key();
504510

505511
try {
506512
// Decode the user

‎lib/WP_Auth0_Options.php‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,12 @@ public function get_default($key) {
4343
return $defaults[$key];
4444
}
4545

46+
public function get_client_secret_as_key() {
47+
$secret = $this->get('client_secret', '');
48+
$isEncoded = $this->get('client_secret_b64_encoded', false);
49+
return $isEncoded ? JWT::urlsafeB64Decode($secret) : $secret;
50+
}
51+
4652
protected function defaults() {
4753
return array(
4854
'version' => 1,
@@ -52,6 +58,7 @@ protected function defaults() {
5258
'auto_login_method' => '',
5359
'client_id' => '',
5460
'client_secret' => '',
61+
'client_secret_b64_enabled' => true,
5562
'domain' => '',
5663
'form_title' => '',
5764
'icon_url' => '',

‎lib/WP_Auth0_Routes.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ protected function migration_ws_login() {
8484
$authorization = $this->getAuthorizationHeader();
8585
$authorization = trim( str_replace( 'Bearer ', '', $authorization ) );
8686

87-
$secret = $this->a0_options->get( 'client_secret' );
87+
$secret = $this->a0_options->get_client_secret_as_key();
8888
$token_id = $this->a0_options->get( 'migration_token_id' );
8989

9090
$user = null;
@@ -94,7 +94,7 @@ protected function migration_ws_login() {
9494
throw new Exception( 'Unauthorized: missing authorization header' );
9595
}
9696

97-
$token = JWT::decode( $authorization, JWT::urlsafeB64Decode( $secret ), array( 'HS256' ) );
97+
$token = JWT::decode( $authorization, $secret, array( 'HS256' ) );
9898

9999
if ( $token->jti != $token_id ) {
100100
throw new Exception( 'Invalid token id' );
@@ -145,7 +145,7 @@ protected function migration_ws_get_user() {
145145
$authorization = $this->getAuthorizationHeader();
146146
$authorization = trim(str_replace('Bearer ', '', $authorization));
147147

148-
$secret = $this->a0_options->get( 'client_secret' );
148+
$secret = $this->a0_options->get_client_secret_as_key();
149149
$token_id = $this->a0_options->get( 'migration_token_id' );
150150

151151
$user = null;
@@ -155,7 +155,7 @@ protected function migration_ws_get_user() {
155155
throw new Exception('Unauthorized: missing authorization header');
156156
}
157157

158-
$token = JWT::decode($authorization, JWT::urlsafeB64Decode( $secret ), array('HS256'));
158+
$token = JWT::decode($authorization, $secret, array('HS256'));
159159

160160
if ($token->jti != $token_id) {
161161
throw new Exception('Invalid token id');

‎lib/WP_Auth0_UsersRepo.php‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,11 +74,23 @@ public function create( $userinfo, $token, $access_token = null, $role = null, $
7474

7575
// If the user doesn't exist we need to either create a new one, or asign him to an existing one
7676
$isDatabaseUser = false;
77-
foreach ( $userinfo->identities as $identity ) {
78-
if ( $identity->provider == "auth0" ) {
77+
78+
if (isset($userinfo->identities)) {
79+
foreach ( $userinfo->identities as $identity ) {
80+
if ( $identity->provider == "auth0" ) {
81+
$isDatabaseUser = true;
82+
}
83+
}
84+
} else {
85+
$sub = $userinfo->sub;
86+
list($provider, $id) = explode('|', $sub);
87+
if ( $provider == "auth0" ) {
7988
$isDatabaseUser = true;
8089
}
8190
}
91+
92+
93+
8294
$joinUser = null;
8395

8496
// If the user has a verified email or is a database user try to see if there is

‎lib/admin/WP_Auth0_Admin_Advanced.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -484,9 +484,9 @@ public function migration_ws_validation( $old_options, $input ) {
484484
if ( $old_options['migration_ws'] != $input['migration_ws'] ) {
485485

486486
if ( 1 == $input['migration_ws'] ) {
487-
$secret = $input['client_secret'];
487+
$secret = $input['client_secret_b64_encoded'] ? JWT::urlsafeB64Decode( $secret) : $input['client_secret'];
488488
$token_id = uniqid();
489-
$input['migration_token'] = JWT::encode( array( 'scope' => 'migration_ws', 'jti' => $token_id ), JWT::urlsafeB64Decode( $secret ) );
489+
$input['migration_token'] = JWT::encode( array( 'scope' => 'migration_ws', 'jti' => $token_id ), $secret );
490490
$input['migration_token_id'] = $token_id;
491491

492492
// if ($response === false) {

‎lib/admin/WP_Auth0_Admin_Basic.php‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ public function init() {
1717
array( 'id' => 'wpa0_domain', 'name' => 'Domain', 'function' => 'render_domain' ),
1818
array( 'id' => 'wpa0_client_id', 'name' => 'Client ID', 'function' => 'render_client_id' ),
1919
array( 'id' => 'wpa0_client_secret', 'name' => 'Client Secret', 'function' => 'render_client_secret' ),
20+
array( 'id' => 'wpa0_client_secret_b64_encoded', 'name' => 'Client Secret Base64 Encoded', 'function' => 'render_client_secret_b64_encoded' ),
2021
array( 'id' => 'wpa0_auth0_app_token', 'name' => 'API token', 'function' => 'render_auth0_app_token' ), //we are not going to show the token
2122
array( 'id' => 'wpa0_login_enabled', 'name' => 'WordPress login enabled', 'function' => 'render_allow_wordpress_login' ),
2223
array( 'id' => 'wpa0_allow_signup', 'name' => 'Allow signup', 'function' => 'render_allow_signup' ),
@@ -73,6 +74,18 @@ public function render_client_secret() {
7374
<?php
7475
}
7576

77+
public function render_client_secret_b64_encoded() {
78+
$v = absint( $this->options->get( 'client_secret_b64_encoded' ) );
79+
80+
echo $this->render_a0_switch( "Not Base64 Enabled", "Base64 Enabled", 1, 1 == $v );
81+
?>
82+
<div class="subelement">
83+
<span class="description"><?php echo __( 'Enable if your client secret is base64 enabled. If you are not sure, check your clients page in Auth0. Displayed below the client secret on that page is the text "The Client Secret is not base64 encoded.
84+
" when this is not encoded.', WPA0_LANG ); ?></span>
85+
</div>
86+
<?php
87+
}
88+
7689
public function render_domain() {
7790
$v = $this->options->get( 'domain' );
7891
?>
@@ -161,6 +174,7 @@ public function basic_validation( $old_options, $input ) {
161174

162175
// Only replace the secret or token if a new value was set. If not, we will keep the last one entered.
163176
$input['client_secret'] = ( !empty( $input['client_secret'] ) ? $input['client_secret'] : $old_options['client_secret'] );
177+
$input['client_secret_b64_encoded'] = ( isset( $input['client_secret_b64_encoded'] ) ? $input['client_secret_b64_encoded'] : 0 );
164178
$input['auth0_app_token'] = ( !empty( $input['auth0_app_token'] ) ? $input['auth0_app_token'] : $old_options['auth0_app_token'] );
165179

166180

0 commit comments

Comments
 (0)