Skip to content

Commit 6fc77d2

Browse files
johnbillionjohnbillion
committed
Application Passwords: Allow plain HTTP success and reject URLs when using a local environment type.
It's not uncommon for local environments to run over HTTP due to the relative complexity of configuring HTTPS for a local environment. This change allows HTTP URLs for application password responses when that is the case. Props peterwilsoncc, wppunk, cadic, viralsampat Fixes #52617 git-svn-id: https://develop.svn.wordpress.org/trunk@55283 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 05c1b0c commit 6fc77d2

File tree

2 files changed

+74
-42
lines changed

2 files changed

+74
-42
lines changed

‎src/wp-admin/includes/user.php

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -612,6 +612,7 @@ function admin_created_user_email( $text ) {
612612
* Checks if the Authorize Application Password request is valid.
613613
*
614614
* @since 5.6.0
615+
* @since 6.2.0 Allow insecure HTTP connections for the local environment.
615616
*
616617
* @param array $request {
617618
* The array of request data. All arguments are optional and may be empty.
@@ -625,12 +626,13 @@ function admin_created_user_email( $text ) {
625626
* @return true|WP_Error True if the request is valid, a WP_Error object contains errors if not.
626627
*/
627628
function wp_is_authorize_application_password_request_valid( $request, $user ) {
628-
$error = new WP_Error();
629+
$error = new WP_Error();
630+
$is_local = 'local' === wp_get_environment_type();
629631

630632
if ( ! empty( $request['success_url'] ) ) {
631633
$scheme = wp_parse_url( $request['success_url'], PHP_URL_SCHEME );
632634

633-
if ( 'http' === $scheme ) {
635+
if ( 'http' === $scheme && ! $is_local ) {
634636
$error->add(
635637
'invalid_redirect_scheme',
636638
__( 'The success URL must be served over a secure connection.' )
@@ -641,7 +643,7 @@ function wp_is_authorize_application_password_request_valid( $request, $user ) {
641643
if ( ! empty( $request['reject_url'] ) ) {
642644
$scheme = wp_parse_url( $request['reject_url'], PHP_URL_SCHEME );
643645

644-
if ( 'http' === $scheme ) {
646+
if ( 'http' === $scheme && ! $is_local ) {
645647
$error->add(
646648
'invalid_redirect_scheme',
647649
__( 'The rejection URL must be served over a secure connection.' )

‎tests/phpunit/tests/admin/includesUser.php

Lines changed: 69 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -7,52 +7,82 @@
77
class Tests_Admin_IncludesUser extends WP_UnitTestCase {
88

99
/**
10-
* @ticket 42790
10+
* Test redirect URLs for application password authorization requests.
11+
*
12+
* @ticket 42790
13+
* @ticket 52617
14+
*
15+
* @covers ::wp_is_authorize_application_password_request_valid
16+
*
1117
* @dataProvider data_is_authorize_application_password_request_valid
12-
* @param array $request The request data to validate.
13-
* @param string $error_code The expected error code, empty if no error.
18+
*
19+
* @param array $request The request data to validate.
20+
* @param string $expected_error_code The expected error code, empty if no error is expected.
21+
* @param string $env The environment type. Defaults to 'production'.
1422
*/
15-
public function test_is_authorize_application_password_request_valid( $request, $error_code ) {
16-
$error = wp_is_authorize_application_password_request_valid( $request, get_userdata( 1 ) );
23+
public function test_is_authorize_application_password_request_valid( $request, $expected_error_code, $env = 'production' ) {
24+
putenv( "WP_ENVIRONMENT_TYPE=$env" );
1725

18-
if ( $error_code ) {
19-
$this->assertWPError( $error );
20-
$this->assertSame( $error_code, $error->get_error_code() );
26+
$actual = wp_is_authorize_application_password_request_valid( $request, get_userdata( 1 ) );
27+
28+
putenv( 'WP_ENVIRONMENT_TYPE' );
29+
30+
if ( $expected_error_code ) {
31+
$this->assertWPError( $actual, 'A WP_Error object is expected.' );
32+
$this->assertSame( $expected_error_code, $actual->get_error_code(), 'Unexpected error code.' );
2133
} else {
22-
$this->assertNotWPError( $error );
34+
$this->assertNotWPError( $actual, 'A WP_Error object is not expected.' );
2335
}
2436
}
2537

2638
public function data_is_authorize_application_password_request_valid() {
27-
return array(
28-
array(
29-
array(),
30-
'',
31-
),
32-
array(
33-
array( 'success_url' => 'http://example.org' ),
34-
'invalid_redirect_scheme',
35-
),
36-
array(
37-
array( 'reject_url' => 'http://example.org' ),
38-
'invalid_redirect_scheme',
39-
),
40-
array(
41-
array( 'success_url' => 'https://example.org' ),
42-
'',
43-
),
44-
array(
45-
array( 'reject_url' => 'https://example.org' ),
46-
'',
47-
),
48-
array(
49-
array( 'success_url' => 'wordpress://example' ),
50-
'',
51-
),
52-
array(
53-
array( 'reject_url' => 'wordpress://example' ),
54-
'',
55-
),
56-
);
39+
$environment_types = array( 'local', 'development', 'staging', 'production' );
40+
41+
$datasets = array();
42+
foreach ( $environment_types as $environment_type ) {
43+
$datasets[ $environment_type . ' and no request arguments' ] = array(
44+
'request' => array(),
45+
'expected_error_code' => '',
46+
'env' => $environment_type,
47+
);
48+
49+
$datasets[ $environment_type . ' and a "https" scheme "success_url"' ] = array(
50+
'request' => array( 'success_url' => 'https://example.org' ),
51+
'expected_error_code' => '',
52+
'env' => $environment_type,
53+
);
54+
55+
$datasets[ $environment_type . ' and a "https" scheme "reject_url"' ] = array(
56+
'request' => array( 'reject_url' => 'https://example.org' ),
57+
'expected_error_code' => '',
58+
'env' => $environment_type,
59+
);
60+
61+
$datasets[ $environment_type . ' and an app scheme "success_url"' ] = array(
62+
'request' => array( 'success_url' => 'wordpress://example' ),
63+
'expected_error_code' => '',
64+
'env' => $environment_type,
65+
);
66+
67+
$datasets[ $environment_type . ' and an app scheme "reject_url"' ] = array(
68+
'request' => array( 'reject_url' => 'wordpress://example' ),
69+
'expected_error_code' => '',
70+
'env' => $environment_type,
71+
);
72+
73+
$datasets[ $environment_type . ' and a "http" scheme "success_url"' ] = array(
74+
'request' => array( 'success_url' => 'http://example.org' ),
75+
'expected_error_code' => 'local' === $environment_type ? '' : 'invalid_redirect_scheme',
76+
'env' => $environment_type,
77+
);
78+
79+
$datasets[ $environment_type . ' and a "http" scheme "reject_url"' ] = array(
80+
'request' => array( 'reject_url' => 'http://example.org' ),
81+
'expected_error_code' => 'local' === $environment_type ? '' : 'invalid_redirect_scheme',
82+
'env' => $environment_type,
83+
);
84+
}
85+
86+
return $datasets;
5787
}
5888
}

0 commit comments

Comments
 (0)