Merge pull request WP-API#19 from WP-API/allow-callback-on-authorize

Set the callback on authorization if given

Author: rachelbaker

lib/class-wp-json-authentication-oauth1-authorize.php

@@ -75,6 +75,13 @@ public function render_page() {
 			return $this->token;
 		}
 
+		if ( ! empty( $_REQUEST['oauth_callback'] ) ) {
+			$resp = $authenticator->set_request_token_callback( $this->token['key'], $_REQUEST['oauth_callback'] );
+			if ( is_wp_error( $resp ) ) {
+				return $resp;
+			}
+		}
+
 		if ( $this->token['authorized'] === true ) {
 			return $this->handle_callback_redirect( $this->token['verifier'] );
 		}

lib/class-wp-json-authentication-oauth1.php

@@ -357,6 +357,21 @@ public function generate_request_token( $params ) {
 		return $data;
 	}
 
+	public function set_request_token_callback( $key, $callback ) {
+		$token = $this->get_request_token( $key );
+		if ( is_wp_error( $token ) ) {
+			return $token;
+		}
+
+		if ( esc_url_raw( $callback ) !== $callback ) {
+			return new WP_Error( 'json_oauth1_invalid_callback', __( 'Callback URL is invalid' ) );
+		}
+
+		$token['callback'] = $callback;
+		update_option( 'oauth1_request_' . $key, $token );
+		return $token['verifier'];
+	}
+
 	/**
 	 * Authorize a request token
 	 *