1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
if ( ! class_exists( 'Jetpack_SSO_Helpers' ) ) : |
4
|
|
|
|
5
|
|
|
/** |
6
|
|
|
* A collection of helper functions used in the SSO module. |
7
|
|
|
* |
8
|
|
|
* @since 4.1.0 |
9
|
|
|
*/ |
10
|
|
|
class Jetpack_SSO_Helpers { |
11
|
|
|
/** |
12
|
|
|
* An array used to store the contents of $_GET before overriding $_GET. |
13
|
|
|
* @var array |
14
|
|
|
*/ |
15
|
|
|
static $stashed_get_params = array(); |
|
|
|
|
16
|
|
|
|
17
|
|
|
/** |
18
|
|
|
* An array used to store the content of $_POST before overriding $_POST. |
19
|
|
|
* @var array |
20
|
|
|
*/ |
21
|
|
|
static $stashed_post_params = array(); |
|
|
|
|
22
|
|
|
|
23
|
|
|
/** |
24
|
|
|
* Determine if the login form should be hidden or not |
25
|
|
|
* |
26
|
|
|
* @return bool |
27
|
|
|
**/ |
28
|
|
|
static function should_hide_login_form() { |
29
|
|
|
/** |
30
|
|
|
* Remove the default log in form, only leave the WordPress.com log in button. |
31
|
|
|
* |
32
|
|
|
* @module sso |
33
|
|
|
* |
34
|
|
|
* @since 3.1.0 |
35
|
|
|
* |
36
|
|
|
* @param bool get_option( 'jetpack_sso_remove_login_form', false ) Should the default log in form be removed. Default to false. |
37
|
|
|
*/ |
38
|
|
|
return (bool) apply_filters( 'jetpack_remove_login_form', get_option( 'jetpack_sso_remove_login_form', false ) ); |
39
|
|
|
} |
40
|
|
|
|
41
|
|
|
/** |
42
|
|
|
* Returns a boolean value for whether logging in by matching the WordPress.com user email to a |
43
|
|
|
* Jetpack site user's email is allowed. |
44
|
|
|
* |
45
|
|
|
* @return bool |
46
|
|
|
*/ |
47
|
|
|
static function match_by_email() { |
48
|
|
|
$match_by_email = ( 1 == get_option( 'jetpack_sso_match_by_email', true ) ) ? true: false; |
49
|
|
|
$match_by_email = defined( 'WPCC_MATCH_BY_EMAIL' ) ? WPCC_MATCH_BY_EMAIL : $match_by_email; |
50
|
|
|
|
51
|
|
|
/** |
52
|
|
|
* Link the local account to an account on WordPress.com using the same email address. |
53
|
|
|
* |
54
|
|
|
* @module sso |
55
|
|
|
* |
56
|
|
|
* @since 2.6.0 |
57
|
|
|
* |
58
|
|
|
* @param bool $match_by_email Should we link the local account to an account on WordPress.com using the same email address. Default to false. |
59
|
|
|
*/ |
60
|
|
|
return (bool) apply_filters( 'jetpack_sso_match_by_email', $match_by_email ); |
61
|
|
|
} |
62
|
|
|
|
63
|
|
|
/** |
64
|
|
|
* Returns a boolean for whether users are allowed to register on the Jetpack site with SSO, |
65
|
|
|
* even though the site disallows normal registrations. |
66
|
|
|
* |
67
|
|
|
* @return bool |
68
|
|
|
*/ |
69
|
|
|
static function new_user_override( $user_data = null ) { |
70
|
|
|
$new_user_override = defined( 'WPCC_NEW_USER_OVERRIDE' ) ? WPCC_NEW_USER_OVERRIDE : false; |
71
|
|
|
|
72
|
|
|
/** |
73
|
|
|
* Allow users to register on your site with a WordPress.com account, even though you disallow normal registrations. |
74
|
|
|
* If you return a string that corresponds to a user role, the user will be given that role. |
75
|
|
|
* |
76
|
|
|
* @module sso |
77
|
|
|
* |
78
|
|
|
* @since 2.6.0 |
79
|
|
|
* @since 4.6 $user_data object is now passed to the jetpack_sso_new_user_override filter |
80
|
|
|
* |
81
|
|
|
* @param bool $new_user_override Allow users to register on your site with a WordPress.com account. Default to false. |
82
|
|
|
* @param object|null $user_data An object containing the user data returned from WordPress.com. |
83
|
|
|
*/ |
84
|
|
|
$role = apply_filters( 'jetpack_sso_new_user_override', $new_user_override, $user_data ); |
85
|
|
|
|
86
|
|
|
if ( $role ) { |
87
|
|
|
if ( is_string( $role ) && get_role( $role ) ) { |
88
|
|
|
return $role; |
89
|
|
|
} else { |
90
|
|
|
return get_option( 'default_role' ); |
91
|
|
|
} |
92
|
|
|
} |
93
|
|
|
|
94
|
|
|
return false; |
95
|
|
|
} |
96
|
|
|
|
97
|
|
|
/** |
98
|
|
|
* Returns a boolean value for whether two-step authentication is required for SSO. |
99
|
|
|
* |
100
|
|
|
* @since 4.1.0 |
101
|
|
|
* |
102
|
|
|
* @return bool |
103
|
|
|
*/ |
104
|
|
|
static function is_two_step_required() { |
105
|
|
|
/** |
106
|
|
|
* Is it required to have 2-step authentication enabled on WordPress.com to use SSO? |
107
|
|
|
* |
108
|
|
|
* @module sso |
109
|
|
|
* |
110
|
|
|
* @since 2.8.0 |
111
|
|
|
* |
112
|
|
|
* @param bool get_option( 'jetpack_sso_require_two_step' ) Does SSO require 2-step authentication? |
113
|
|
|
*/ |
114
|
|
|
return (bool) apply_filters( 'jetpack_sso_require_two_step', get_option( 'jetpack_sso_require_two_step', false ) ); |
115
|
|
|
} |
116
|
|
|
|
117
|
|
|
/** |
118
|
|
|
* Returns a boolean for whether a user that is attempting to log in will be automatically |
119
|
|
|
* redirected to WordPress.com to begin the SSO flow. |
120
|
|
|
* |
121
|
|
|
* @return bool |
122
|
|
|
*/ |
123
|
|
|
static function bypass_login_forward_wpcom() { |
124
|
|
|
/** |
125
|
|
|
* Redirect the site's log in form to WordPress.com's log in form. |
126
|
|
|
* |
127
|
|
|
* @module sso |
128
|
|
|
* |
129
|
|
|
* @since 3.1.0 |
130
|
|
|
* |
131
|
|
|
* @param bool false Should the site's log in form be automatically forwarded to WordPress.com's log in form. |
132
|
|
|
*/ |
133
|
|
|
return (bool) apply_filters( 'jetpack_sso_bypass_login_forward_wpcom', false ); |
134
|
|
|
} |
135
|
|
|
|
136
|
|
|
/** |
137
|
|
|
* Returns a boolean for whether the SSO login form should be displayed as the default |
138
|
|
|
* when both the default and SSO login form allowed. |
139
|
|
|
* |
140
|
|
|
* @since 4.1.0 |
141
|
|
|
* |
142
|
|
|
* @return bool |
143
|
|
|
*/ |
144
|
|
|
static function show_sso_login() { |
145
|
|
|
if ( self::should_hide_login_form() ) { |
146
|
|
|
return true; |
147
|
|
|
} |
148
|
|
|
|
149
|
|
|
/** |
150
|
|
|
* Display the SSO login form as the default when both the default and SSO login forms are enabled. |
151
|
|
|
* |
152
|
|
|
* @module sso |
153
|
|
|
* |
154
|
|
|
* @since 4.1.0 |
155
|
|
|
* |
156
|
|
|
* @param bool true Should the SSO login form be displayed by default when the default login form is also enabled? |
157
|
|
|
*/ |
158
|
|
|
return (bool) apply_filters( 'jetpack_sso_default_to_sso_login', true ); |
159
|
|
|
} |
160
|
|
|
|
161
|
|
|
/** |
162
|
|
|
* Returns a boolean for whether the two step required checkbox, displayed on the Jetpack admin page, should be disabled. |
163
|
|
|
* |
164
|
|
|
* @since 4.1.0 |
165
|
|
|
* |
166
|
|
|
* @return bool |
167
|
|
|
*/ |
168
|
|
|
static function is_require_two_step_checkbox_disabled() { |
169
|
|
|
return (bool) has_filter( 'jetpack_sso_require_two_step' ); |
170
|
|
|
} |
171
|
|
|
|
172
|
|
|
/** |
173
|
|
|
* Returns a boolean for whether the match by email checkbox, displayed on the Jetpack admin page, should be disabled. |
174
|
|
|
* |
175
|
|
|
* @since 4.1.0 |
176
|
|
|
* |
177
|
|
|
* @return bool |
178
|
|
|
*/ |
179
|
|
|
static function is_match_by_email_checkbox_disabled() { |
180
|
|
|
return defined( 'WPCC_MATCH_BY_EMAIL' ) || has_filter( 'jetpack_sso_match_by_email' ); |
181
|
|
|
} |
182
|
|
|
|
183
|
|
|
/** |
184
|
|
|
* Returns an array of hosts that SSO will redirect to. |
185
|
|
|
* |
186
|
|
|
* Instead of accessing JETPACK__API_BASE within the method directly, we set it as the |
187
|
|
|
* default for $api_base due to restrictions with testing constants in our tests. |
188
|
|
|
* |
189
|
|
|
* @since 4.3.0 |
190
|
|
|
* @since 4.6.0 Added public-api.wordpress.com as an allowed redirect |
191
|
|
|
* |
192
|
|
|
* @param array $hosts |
193
|
|
|
* @param string $api_base |
194
|
|
|
* |
195
|
|
|
* @return array |
196
|
|
|
*/ |
197
|
|
|
static function allowed_redirect_hosts( $hosts, $api_base = JETPACK__API_BASE ) { |
198
|
|
|
if ( empty( $hosts ) ) { |
199
|
|
|
$hosts = array(); |
200
|
|
|
} |
201
|
|
|
|
202
|
|
|
$hosts[] = 'wordpress.com'; |
203
|
|
|
$hosts[] = 'jetpack.wordpress.com'; |
204
|
|
|
$hosts[] = 'public-api.wordpress.com'; |
205
|
|
|
|
206
|
|
|
if ( |
207
|
|
|
( Jetpack::is_development_mode() || Jetpack::is_development_version() ) && |
208
|
|
|
( false === strpos( $api_base, 'jetpack.wordpress.com/jetpack' ) ) |
209
|
|
|
) { |
210
|
|
|
$base_url_parts = parse_url( esc_url_raw( $api_base ) ); |
211
|
|
|
if ( $base_url_parts && ! empty( $base_url_parts[ 'host' ] ) ) { |
212
|
|
|
$hosts[] = $base_url_parts[ 'host' ]; |
213
|
|
|
} |
214
|
|
|
} |
215
|
|
|
|
216
|
|
|
return array_unique( $hosts ); |
217
|
|
|
} |
218
|
|
|
|
219
|
|
|
static function generate_user( $user_data ) { |
220
|
|
|
$username = $user_data->login; |
221
|
|
|
|
222
|
|
|
/** |
223
|
|
|
* Determines how many times the SSO module can attempt to randomly generate a user. |
224
|
|
|
* |
225
|
|
|
* @module sso |
226
|
|
|
* |
227
|
|
|
* @since 4.3.2 |
228
|
|
|
* |
229
|
|
|
* @param int 5 By default, SSO will attempt to random generate a user up to 5 times. |
230
|
|
|
*/ |
231
|
|
|
$num_tries = intval( apply_filters( 'jetpack_sso_allowed_username_generate_retries', 5 ) ); |
232
|
|
|
|
233
|
|
|
$tries = 0; |
234
|
|
|
while ( ( $exists = username_exists( $username ) ) && $tries++ < $num_tries ) { |
235
|
|
|
$username = $user_data->login . '_' . $user_data->ID . '_' . mt_rand(); |
236
|
|
|
} |
237
|
|
|
|
238
|
|
|
if ( $exists ) { |
239
|
|
|
return false; |
240
|
|
|
} |
241
|
|
|
|
242
|
|
|
$password = wp_generate_password( 20 ); |
243
|
|
|
$user_id = wp_create_user( $username, $password, $user_data->email ); |
244
|
|
|
$user = get_userdata( $user_id ); |
245
|
|
|
|
246
|
|
|
$user->display_name = $user_data->display_name; |
247
|
|
|
$user->first_name = $user_data->first_name; |
248
|
|
|
$user->last_name = $user_data->last_name; |
249
|
|
|
$user->url = $user_data->url; |
250
|
|
|
$user->description = $user_data->description; |
251
|
|
|
|
252
|
|
|
if ( isset( $user_data->role ) && $user_data->role ) { |
253
|
|
|
$user->role = $user_data->role; |
|
|
|
|
254
|
|
|
} |
255
|
|
|
|
256
|
|
|
wp_update_user( $user ); |
257
|
|
|
|
258
|
|
|
update_user_meta( $user->ID, 'wpcom_user_id', $user_data->ID ); |
259
|
|
|
|
260
|
|
|
return $user; |
261
|
|
|
} |
262
|
|
|
|
263
|
|
|
static function extend_auth_cookie_expiration_for_sso() { |
264
|
|
|
/** |
265
|
|
|
* Determines how long the auth cookie is valid for when a user logs in with SSO. |
266
|
|
|
* |
267
|
|
|
* @module sso |
268
|
|
|
* |
269
|
|
|
* @since 4.4.0 |
270
|
|
|
* |
271
|
|
|
* @param int YEAR_IN_SECONDS |
272
|
|
|
*/ |
273
|
|
|
return intval( apply_filters( 'jetpack_sso_auth_cookie_expirtation', YEAR_IN_SECONDS ) ); |
274
|
|
|
} |
275
|
|
|
|
276
|
|
|
/** |
277
|
|
|
* Determines if the SSO form should be displayed for the current action. |
278
|
|
|
* |
279
|
|
|
* @param string $action |
280
|
|
|
* |
281
|
|
|
* @return bool Is SSO allowed for the current action? |
282
|
|
|
*/ |
283
|
|
|
static function display_sso_form_for_action( $action ) { |
284
|
|
|
/** |
285
|
|
|
* Allows plugins the ability to overwrite actions where the SSO form is allowed to be used. |
286
|
|
|
* |
287
|
|
|
* @module sso |
288
|
|
|
* |
289
|
|
|
* @since 4.6.0 |
290
|
|
|
* |
291
|
|
|
* @param array $allowed_actions_for_sso |
292
|
|
|
*/ |
293
|
|
|
$allowed_actions_for_sso = (array) apply_filters( 'jetpack_sso_allowed_actions', array( |
294
|
|
|
'login', |
295
|
|
|
'jetpack_json_api_authorization', |
296
|
|
|
) ); |
297
|
|
|
return in_array( $action, $allowed_actions_for_sso ); |
298
|
|
|
} |
299
|
|
|
|
300
|
|
|
/** |
301
|
|
|
* Given a URL that is the original request which kicked off the SSO flow, this function returns whether |
302
|
|
|
* the request was for Jetpack JSON API authorization by checking the value of `$action`. |
303
|
|
|
* |
304
|
|
|
* @param string $original_request |
305
|
|
|
* |
306
|
|
|
* @return bool Was the original request for JSON API authorization? |
307
|
|
|
*/ |
308
|
|
|
static function is_sso_for_json_api_auth( $original_request ) { |
309
|
|
|
$original_request = esc_url_raw( $original_request ); |
310
|
|
|
|
311
|
|
|
$parsed_url = wp_parse_url( $original_request ); |
312
|
|
|
if ( empty( $parsed_url ) || empty( $parsed_url['query'] ) ) { |
313
|
|
|
return false; |
314
|
|
|
} |
315
|
|
|
|
316
|
|
|
$args = array(); |
317
|
|
|
wp_parse_str( $parsed_url['query'], $args ); |
318
|
|
|
|
319
|
|
|
if ( empty( $args ) || empty( $args['action'] ) ) { |
320
|
|
|
return false; |
321
|
|
|
} |
322
|
|
|
|
323
|
|
|
return 'jetpack_json_api_authorization' === $args['action']; |
324
|
|
|
} |
325
|
|
|
|
326
|
|
|
/** |
327
|
|
|
* Given a URL that is the original request which kicked off the SSO flow, this function stores the contents of |
328
|
|
|
* $_GET and $_POST into static variables of this class and then updates $_GET and $_POST to match the original |
329
|
|
|
* request. This is done so that we can verify the JSON API authorization request. |
330
|
|
|
* |
331
|
|
|
* @param string $original_request |
332
|
|
|
* |
333
|
|
|
* @return bool Were the superglobal values updated to mathch the original request? |
334
|
|
|
*/ |
335
|
|
|
static function set_superglobal_values_for_json_api_auth( $original_request ) { |
336
|
|
|
$original_request = esc_url_raw( $original_request ); |
337
|
|
|
|
338
|
|
|
$parsed_url = wp_parse_url( $original_request ); |
339
|
|
|
if ( empty( $parsed_url ) || empty( $parsed_url['query'] ) ) { |
340
|
|
|
return false; |
341
|
|
|
} |
342
|
|
|
|
343
|
|
|
$args = array(); |
344
|
|
|
wp_parse_str( $parsed_url['query'], $args ); |
345
|
|
|
|
346
|
|
|
if ( empty( $args ) || empty( $args['action'] ) ) { |
347
|
|
|
return false; |
348
|
|
|
} |
349
|
|
|
|
350
|
|
|
if ( 'jetpack_json_api_authorization' !== $args['action'] ) { |
351
|
|
|
return false; |
352
|
|
|
} |
353
|
|
|
|
354
|
|
|
self::$stashed_get_params = $_GET; |
355
|
|
|
self::$stashed_post_params = $_POST; |
356
|
|
|
|
357
|
|
|
$_GET = $args; |
358
|
|
|
$_POST['jetpack_json_api_original_query'] = $original_request; |
359
|
|
|
|
360
|
|
|
return true; |
361
|
|
|
} |
362
|
|
|
|
363
|
|
|
/** |
364
|
|
|
* This function is meant to be run after calling self::set_superglobal_values_for_json_api_auth( $original_request) |
365
|
|
|
* and resets the superglobals back to their original values. |
366
|
|
|
*/ |
367
|
|
|
static function reset_superglobal_values_after_json_api_auth() { |
368
|
|
|
$_POST = self::$stashed_post_params; |
369
|
|
|
$_GET = self::$stashed_get_params; |
370
|
|
|
} |
371
|
|
|
} |
372
|
|
|
|
373
|
|
|
endif; |
374
|
|
|
|
The PSR-2 coding standard requires that all properties in a class have their visibility explicitly declared. If you declare a property using
the property is implicitly global.
To learn more about the PSR-2, please see the PHP-FIG site on the PSR-2.