first commit

Author: geckod22

includes/SSO_Helpers.php

@@ -126,8 +126,10 @@ public static function shouldThrottle() {
 
 	/**
 	 * Trigger an SSO failure.
+	 *
+	 * @param string $error_type type of error
 	 */
-	public static function triggerFailure() {
+	public static function triggerFailure( $error_type = '') {
 
 		self::logFailure();
 
@@ -138,7 +140,18 @@ public static function triggerFailure() {
 
 		do_action( 'newfold_sso_fail' );
 
-		wp_safe_redirect( wp_login_url() );
+		if ( empty( $error_type ) ) {
+			wp_safe_redirect( wp_login_url() );
+		} else {
+			wp_safe_redirect(
+				add_query_arg(
+					array(
+						'error'   => $error_type,
+					),
+					wp_login_url()
+				)
+			);
+		}
 		exit;
 
 	}
@@ -248,7 +261,14 @@ public static function handleLogin( $token ) {
 			exit;
 		}
 
-		self::triggerSuccess( self::getUserFromToken( $token ) );
+		$user = self::getUserFromToken( $token );
+		if ( $user ) {
+			if ( preg_match("/['\"\\\\]/", $user->user_login ) ) {
+				self::triggerFailure( 'invalid_username' );
+				exit;
+			}
+		}
+		self::triggerSuccess( $user );
 
 	}
 

includes/SSO_Helpers_Legacy.php

@@ -38,6 +38,13 @@ public static function handleLegacyLogin( $nonce, $salt ) {
 			exit;
 		}
 
+		if ( $user ) {
+			if ( preg_match("/['\"\\\\]/", $user->user_login ) ) {
+				self::triggerFailure( 'invalid_username' );
+				exit;
+			}
+		}
+
 		// Validate token
 		$token        = substr( base64_encode( hash( 'sha256', $nonce . $salt, false ) ), 0, 64 );
 		$stored_token = get_transient( 'sso_token' );

sso.php

@@ -28,13 +28,29 @@ function() {
 	}
 );
 
-\add_action( 'init',
+add_action( 'init',
 	function() {
-		\load_plugin_textdomain(
+		load_plugin_textdomain(
 			'wp-module-sso',
 			false,
 			NFD_SSO_DIR . '/languages'
 		);
 	}, 
 	100 
 );
+
+add_action( 'login_message', function() {
+	$error = sanitize_key( $_GET['error'] ?? '' );
+	if ( ! empty( $error ) ) {
+		$message = '';
+		switch ( $error ) {
+			case 'invalid_username':
+				$message = __( 'SSO failed: username cannot contain invalid characters.', 'wp-module-sso' );
+				break;
+			default:
+				$message = __( 'An unknown error occurred. Please try again.', 'wp-module-sso' );
+				break;
+		}
+		return "<div class='login-error' style='color: red; font-weight: bold;'>{$message}</div>";
+	}
+});