Changeset 8069

Timestamp:

06/11/08 17:25:55 (3 months ago)

Author:

ryan

Message:

Introduce logged_in cookie. Deliver auth cookies only to wp-admin. see #7001

Files:

• trunk/wp-admin/admin-header.php (modified) (1 diff)
• trunk/wp-includes/functions.php (modified) (1 diff)
• trunk/wp-includes/general-template.php (modified) (2 diffs)
• trunk/wp-includes/link-template.php (modified) (2 diffs)
• trunk/wp-includes/pluggable.php (modified) (14 diffs)
• trunk/wp-includes/user.php (modified) (4 diffs)
• trunk/wp-login.php (modified) (7 diffs)
• trunk/wp-settings.php (modified) (2 diffs)

trunk/wp-admin/admin-header.php

@@ -112 +112 @@
-<?php } ?>
-
-
+, 'login'
-
-<?php

trunk/wp-includes/functions.php

@@ -1769 +1769 @@
-    return ( 'on' == strtolower($_SERVER['HTTPS']) ) ? true : false; 
-}
+
+function force_ssl_login($force = '') {
+    static $forced;
+
+    if ( '' != $force ) {
+        $old_forcded = $forced;
+        $forced = $force;
+        return $old_forced;
+    }
+
+    return $forced;
+}
+
+function force_ssl_admin($force = '') {
+    static $forced;
+
+    if ( '' != $force ) {
+        $old_forcded = $forced;
+        $forced = $force;
+        return $old_forced;
+    }
+
+    return $forced;
+}
+
-?>

trunk/wp-includes/general-template.php

@@ -34 +34 @@
-function wp_loginout() {
-    if ( ! is_user_logged_in() )
-forceable
+login
-    else
-forceable
+login
-
-    echo apply_filters('loginout', $link);
@@ -46 +46 @@
-    if ( ! is_user_logged_in() ) {
-        if ( get_option('users_can_register') )
-forceable
+login
-        else
-            $link = '';

trunk/wp-includes/link-template.php

@@ -781 +781 @@
-    // should the list of allowed schemes be maintained elsewhere?
-    if ( !in_array($scheme, array('http', 'https')) ) {
-
+
+
+
-            $scheme = 'https';
-        else
@@ -798 +800 @@
-    global $_wp_admin_url;
-
-forceable
+admin
-
-    if ( !empty($path) && is_string($path) && strpos($path, '..') === false )

trunk/wp-includes/pluggable.php

@@ -101 +101 @@
-
-    if ( ! $user = wp_validate_auth_cookie() ) {
-
-
+
+
+
+
-    }
-
@@ -466 +468 @@
- *
- * @param string $cookie Optional. If used, will validate contents instead of cookie's
+ * @param string $scheme Optional. The cookie scheme to use: auth, secure_auth, or logged_in
- * @return bool|int False if invalid cookie, User ID if valid.
- */
-
+, $scheme = 'auth'
-    if ( empty($cookie) ) {
-
+ {
-            $cookie_name = SECURE_AUTH_COOKIE;
-
+
+
-            $cookie_name = AUTH_COOKIE;
+            $scheme = 'auth';
+        }
-
-        if ( empty($_COOKIE[$cookie_name]) )
@@ -496 +502 @@
-        return false;
-
-
+, $scheme
-    $hash = hash_hmac('md5', $username . '|' . $expiration, $key);
-
@@ -520 +526 @@
- * @param int $user_id User ID
- * @param int $expiration Cookie expiration in seconds
-bool $secure Whether the cookie is for https delivery only or not.  Not used by default.  For plugin use.
+string $scheme Optional. The cookie scheme to use: auth, secure_auth, or logged_in
- * @return string Authentication cookie contents
- */
-ecure = false
+cheme = 'auth'
-    $user = get_userdata($user_id);
-
-
+, $scheme
-    $hash = hash_hmac('md5', $user->user_login . '|' . $expiration, $key);
-
-    $cookie = $user->user_login . '|' . $expiration . '|' . $hash;
-
-ecur
+chem
-}
-endif;
@@ -549 +555 @@
- * @param bool $remember Whether to remember the user or not
- */
-
+, $secure = ''
-    if ( $remember ) {
-        $expiration = $expire = time() + 1209600;
@@ -557 +563 @@
-    }
-
-
-
-
+
+
+
+
+
+
-    } else {
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
-    if ( COOKIEPATH != SITECOOKIEPATH )
-$cookie_name, $cookie, $expire, SITECOOKIEPATH, COOKIE_DOMAIN, $secure
+LOGGED_IN_COOKIE, $logged_in_cookie, $expire, SITECOOKIEPATH, COOKIE_DOMAIN
-}
-endif;
@@ -582 +594 @@
- */
-function wp_clear_auth_cookie() {
-
-
-
-
+
+
+
+
+
+
-
-    // Old cookies
@@ -622 +636 @@
-    // Checks if a user is logged in, if not redirects them to the login page
-
-(defined('FORCE_SSL_LOGIN') && FORCE_SSL_LOGIN
+force_ssl_admin(
-        $secure = true;
-    else
@@ -629 +643 @@
-    // If https is required and request is http, redirect
-    if ( $secure && !is_ssl() ) {
-false !
-str_replace('http://
+0 =
+preg_replace('|^http://|
-            exit();
-        } else {
@@ -644 +658 @@
-    nocache_headers();
-
-
+
+
+
+
+
+
-
-    wp_redirect($login_url);
@@ -972 +991 @@
-    $message  = sprintf(__('Username: %s'), $user_login) . "\r\n";
-    $message .= sprintf(__('Password: %s'), $plaintext_pass) . "\r\n";
-forceable
+login
-
-    wp_mail($user_email, sprintf(__('[%s] Your username and password'), get_option('blogname')), $message);
@@ -1079 +1098 @@
- * @return string Salt value from either 'SECRET_KEY' or 'secret' option
- */
-
+$scheme = 'auth'
-    global $wp_default_secret_key;
-    $secret_key = '';
@@ -1085 +1104 @@
-        $secret_key = SECRET_KEY;
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        }
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-}
-endif;
@@ -1109 +1161 @@
- * @return string Hash of $data
- */
-
-
+, $scheme = 'auth'
+$scheme
-
-    return hash_hmac('md5', $data, $salt);

trunk/wp-includes/user.php

@@ -1 +1 @@
-<?php
-
-
+, $secure_cookie = ''
-    if ( empty($credentials) ) {
-        if ( ! empty($_POST['log']) )
@@ -22 +22 @@
-    do_action_ref_array('wp_authenticate', array(&$credentials['user_login'], &$credentials['user_password']));
-
+    if ( '' === $secure_cookie )
+        $secure_cookie = is_ssl() ? true : false;
+    
-    // If no credential info provided, check cookie.
-    if ( empty($credentials['user_login']) && empty($credentials['user_password']) ) {
@@ -28 +31 @@
-                return new WP_User($user);
-
-
+
+
+
+
+
+
-                return new WP_Error('expired_session', __('Please log in again.'));
-
@@ -49 +57 @@
-        return $user;
-
-
+, $secure_cookie
-    do_action('wp_login', $credentials['user_login']);
-    return $user;

trunk/wp-login.php

@@ -11 +11 @@
-/** Make sure that the WordPress bootstrap has ran before continuing. */
-require( dirname(__FILE__) . '/wp-load.php' );
+
+// Redirect to https login if forced to use SSL
+if ( (force_ssl_admin() || force_ssl_login()) && !is_ssl() ) {
+    if ( 0 === strpos($_SERVER['REQUEST_URI'], 'http') ) {
+        wp_redirect(preg_replace('|^http://|', 'https://', $_SERVER['REQUEST_URI']));
+        exit();
+    } else {
+        wp_redirect('https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
+        exit();         
+    }
+}
-
-/**
@@ -138 +149 @@
-    $message .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n";
-    $message .= __('To reset your password visit the following address, otherwise just ignore this email and nothing will happen.') . "\r\n\r\n";
-
+, 'login'
-
-    if ( !wp_mail($user_email, sprintf(__('[%s] Password Reset'), get_option('blogname')), $message) )
@@ -175 +186 @@
-    $message  = sprintf(__('Username: %s'), $user->user_login) . "\r\n";
-    $message .= sprintf(__('Password: %s'), $new_pass) . "\r\n";
-
+, 'login'
-
-    if (  !wp_mail($user->user_email, sprintf(__('[%s] Your new password'), get_option('blogname')), $message) )
@@ -313 +324 @@
-<p id="nav">
-<?php if (get_option('users_can_register')) : ?>
-forceable
-
+login
+, 'login'
-<?php else : ?>
-forceable
+login
-<?php endif; ?>
-</p>
@@ -381 +392 @@
-
-<p id="nav">
-forceable
-
+login
+, 'login'
-</p>
-
@@ -396 +407 @@
-case 'login' :
-default:
-    $user = wp_signon();
-
-    if ( isset( $_REQUEST['redirect_to'] ) )
-        $redirect_to = $_REQUEST['redirect_to'];
-    else
-        $redirect_to = 'wp-admin/';
+
+    if ( is_ssl() && force_ssl_login() && !force_ssl_admin() && ( 0 !== strpos($redirect_to, 'https') ) )
+        $secure_cookie = false;
+    else
+        $secure_cookie = '';
+
+    $user = wp_signon('', $secure_cookie);
-
-    if ( !is_wp_error($user) ) {
@@ -455 +471 @@
-<?php if ( isset($_GET['checkemail']) && in_array( $_GET['checkemail'], array('confirm', 'newpass') ) ) : ?>
-<?php elseif (get_option('users_can_register')) : ?>
-
-
+, 'login'
+, 'login'
-<?php else : ?>
-
+, 'login'
-<?php endif; ?>
-</p>

trunk/wp-settings.php

@@ -335 +335 @@
-/**
- * It is possible to define this in wp-config.php
+ * @since 2.6
+ */
+if ( !defined('LOGGED_IN_COOKIE') )
+    define('LOGGED_IN_COOKIE', 'wordpress_logged_in_' . COOKIEHASH);
+
+/**
+ * It is possible to define this in wp-config.php
- * @since 2.3.0
- */
@@ -360 +367 @@
-if ( !defined('COOKIE_DOMAIN') )
-    define('COOKIE_DOMAIN', false);
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-/**
- * It is possible to define this in wp-config.php