Skip to content

Commit 44246d9

Browse files
dshanskedshanske
authored
Merge pull request #136 from dshanske/header
Add nag notice and new script for checking headers
2 parents 542110d + 4cc9cff commit 44246d9

11 files changed

+272
-64
lines changed

‎includes/class-indieauth-admin.php‎

Lines changed: 56 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,42 @@ public function __construct() {
99
// initialize admin settings
1010
add_action( 'admin_init', array( $this, 'admin_init' ) );
1111
add_action( 'init', array( $this, 'settings' ) );
12-
12+
add_action( 'login_form_authdiag', array( $this, 'login_form_authdiag' ) );
1313
add_action( 'admin_menu', array( $this, 'admin_menu' ) );
1414
}
1515

16+
public function login_form_authdiag() {
17+
$return = '';
18+
if ( 'POST' === $_SERVER['REQUEST_METHOD'] ) {
19+
if ( ! empty( $_SERVER['HTTP_AUTHORIZATION'] ) && 'Bearer abc123' === $_SERVER['HTTP_AUTHORIZATION'] ) {
20+
$return = '<div class="notice notice-success"><p>' . esc_html__( 'Authorization Header Found. You should be able to use all clients.', 'indieauth' ) . '</p></div>';
21+
update_option( 'indieauth_header_check', 1 );
22+
} elseif ( ! empty( $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ) && 'Bearer abc123' === $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ) {
23+
$return = '<div class="notice-success"><p>' . esc_html__( 'Alternate Header Found. You should be able to use all clients.', 'indieauth' ) . '</p></div>';
24+
update_option( 'indieauth_header_check', 1 );
25+
}
26+
if ( empty( $return ) ) {
27+
ob_start();
28+
include plugin_dir_path( __DIR__ ) . 'templates/authdiagfail.php';
29+
$return = ob_get_contents();
30+
ob_end_clean();
31+
}
32+
if ( 'application/json' === $_SERVER['HTTP_ACCEPT'] ) {
33+
header( 'Content-Type: application/json' );
34+
$return = wp_json_encode( array( 'message' => $return ) );
35+
}
36+
echo $return;
37+
exit;
38+
}
39+
$args = array(
40+
'action' => 'authdiag',
41+
);
42+
$url = add_query_params_to_url( $args, wp_login_url() );
43+
include plugin_dir_path( __DIR__ ) . 'templates/authdiagtest.php';
44+
exit;
45+
}
46+
47+
1648
public function settings() {
1749
register_setting(
1850
'indieauth',
@@ -74,6 +106,28 @@ public function admin_menu() {
74106
* Load settings page
75107
*/
76108
public function settings_page() {
109+
$response = wp_remote_post(
110+
add_query_params_to_url(
111+
array(
112+
'action' => 'authdiag',
113+
),
114+
wp_login_url()
115+
),
116+
array(
117+
'method' => 'POST',
118+
'headers' => array(
119+
'Authorization' => 'Bearer abc123',
120+
'Accept' => 'application/json',
121+
),
122+
)
123+
);
124+
if ( ! is_wp_error( $response ) ) {
125+
$json = json_decode( wp_remote_retrieve_body( $response ) );
126+
set_query_var( 'authdiag_message', $json->message );
127+
} else {
128+
set_query_var( 'authdiag_message', 'Fail' );
129+
}
130+
77131
load_template( plugin_dir_path( __DIR__ ) . '/templates/indieauth-settings.php' );
78132
}
79133

@@ -85,7 +139,7 @@ public function add_help_tab() {
85139
'title' => __( 'Overview', 'indieauth' ),
86140
'content' =>
87141
'<p>' . __( 'IndieAuth is a way for doing Web sign-in, where you use your own homepage to sign in to other places.', 'indieauth' ) . '</p>' .
88-
'<p>' . __( 'IndieAuth was build on ideas and technology from existing proven technologies like OAuth and OpenID but aims at making it easier for users as well as developers. It also decentralises much of the process so completely separate implementations and services can be used for each part.', 'indieauth' ) . '</p>',
142+
'<p>' . __( 'IndieAuth was built on ideas and technology from existing proven technologies like OAuth and OpenID but aims at making it easier for users as well as developers. It also decentralises much of the process so completely separate implementations and services can be used for each part.', 'indieauth' ) . '</p>',
89143
)
90144
);
91145

‎includes/class-indieauth-authorization-endpoint.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ class IndieAuth_Authorization_Endpoint {
1111
public function __construct() {
1212
add_action( 'rest_api_init', array( $this, 'register_routes' ) );
1313
add_action( 'login_form_indieauth', array( $this, 'login_form_indieauth' ) );
14+
1415
$this->tokens = new Token_User( '_indieauth_code_' );
1516
}
1617

‎includes/class-indieauth-authorize.php‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -162,22 +162,24 @@ public static function verify_authorization_code( $post_args ) {
162162
* @return string|null Authorization header if set, null otherwise
163163
*/
164164
public function get_authorization_header() {
165+
$auth = null;
165166
if ( ! empty( $_SERVER['HTTP_AUTHORIZATION'] ) ) {
166-
return wp_unslash( $_SERVER['HTTP_AUTHORIZATION'] );
167-
}
168-
169-
// When Apache speaks via FastCGI with PHP, then the authorization header is often available as REDIRECT_HTTP_AUTHORIZATION.
170-
if ( ! empty( $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ) ) {
171-
return wp_unslash( $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] );
172-
}
173-
$headers = getallheaders();
174-
// Check for the authorization header case-insensitively
175-
foreach ( $headers as $key => $value ) {
176-
if ( strtolower( $key ) === 'authorization' ) {
177-
return $value;
167+
$auth = wp_unslash( $_SERVER['HTTP_AUTHORIZATION'] );
168+
} elseif ( ! empty( $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ) ) {
169+
// When Apache speaks via FastCGI with PHP, then the authorization header is often available as REDIRECT_HTTP_AUTHORIZATION.
170+
$auth = wp_unslash( $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] );
171+
} else {
172+
$headers = getallheaders();
173+
// Check for the authorization header case-insensitively
174+
foreach ( $headers as $key => $value ) {
175+
if ( strtolower( $key ) === 'authorization' ) {
176+
$auth = wp_unslash( $value );
177+
break;
178+
}
178179
}
179180
}
180-
return null;
181+
182+
return $auth;
181183
}
182184

183185
/**

‎includes/class-indieauth-token-endpoint.php‎

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -78,10 +78,22 @@ public function get_token( $token, $hash = true ) {
7878
}
7979

8080
public function get( $request ) {
81-
$params = $request->get_params();
82-
$access_token = $this->get_token_from_bearer_header( $request->get_header( 'Authorization' ) );
81+
$params = $request->get_params();
82+
$header = $request->get_header( 'Authorization' );
83+
if ( ! $header && ! empty( $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ) ) {
84+
$header = wp_unslash( $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] );
85+
}
86+
$access_token = $this->get_token_from_bearer_header( $header );
8387
if ( ! $access_token ) {
84-
return new WP_OAuth_Response( 'parameter_absent', __( 'Bearer Token Not Supplied', 'indieauth' ), 400 );
88+
return new WP_OAuth_Response(
89+
'parameter_absent',
90+
__(
91+
'Bearer Token Not Supplied or Server Misconfigured to Not Pass Token. Run diagnostic script in WordPress Admin
92+
IndieAuth Settings Page',
93+
'indieauth'
94+
),
95+
400
96+
);
8597
}
8698
$token = $this->get_token( $access_token );
8799
if ( ! $token ) {
@@ -164,7 +176,23 @@ public function request( $params ) {
164176
}
165177
if ( $token ) {
166178
// Return only the standard keys in the response
167-
return( wp_array_slice_assoc( $token, array( 'access_token', 'token_type', 'scope', 'me', 'profile' ) ) );
179+
return new WP_REST_Response(
180+
wp_array_slice_assoc(
181+
$token,
182+
array(
183+
'access_token',
184+
'token_type',
185+
'scope',
186+
'me',
187+
'profile',
188+
)
189+
),
190+
200, // Status Code
191+
array(
192+
'Cache-Control' => 'no-store',
193+
'Pragma' => 'no-cache',
194+
)
195+
);
168196
}
169197
} else {
170198
return new WP_OAuth_Response( 'invalid_grant', __( 'This authorization code was issued with no scope, so it cannot be used to obtain an access token', 'indieauth' ), 400 );

‎indieauth.php‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* Plugin Name: IndieAuth
44
* Plugin URI: https://github.com/indieweb/wordpress-indieauth/
55
* Description: IndieAuth is a way to allow users to use their own domain to sign into other websites and services
6-
* Version: 3.3.1
6+
* Version: 3.3.2
77
* Author: IndieWebCamp WordPress Outreach Club
88
* Author URI: https://indieweb.org/WordPress_Outreach_Club
99
* License: MIT
@@ -53,6 +53,17 @@ public function __construct() {
5353
if ( WP_DEBUG ) {
5454
require_once plugin_dir_path( __FILE__ ) . 'includes/class-indieauth-debug.php';
5555
}
56+
57+
add_action( 'admin_notices', array( $this, 'admin_notices' ) );
58+
}
59+
60+
public function admin_notices() {
61+
if ( ! get_option( 'indieauth_header_check', 0 ) ) {
62+
echo '<p class="notice notice-warning">';
63+
_e( 'In order to ensure IndieAuth tokens will work please perform this check:', 'indieauth' );
64+
printf( ' <a href="%1s">%2$s</a>', add_query_arg( 'action', 'authdiag', wp_login_url() ), __( 'Check Script', 'indieauth' ) );
65+
echo '</p>';
66+
}
5667
}
5768

5869
public function pre_user_url( $user_url ) {

0 commit comments

Comments
 (0)