Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The OAuth callback validator was overly aggressive. Desktop applications... #33

Closed
wants to merge 2 commits into from
Closed

The OAuth callback validator was overly aggressive. Desktop applications... #33

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3d9f9fe
The OAuth callback validator was overly aggressive. Desktop applicati…
trevordevore Sep 17, 2014
51154ac
Added the filter callback.
trevordevore Sep 17, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 18 additions & 3 deletions lib/class-wp-json-authentication-oauth1-authorize.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,8 +152,14 @@ public function handle_callback_redirect( $verifier ) {
$callback = $this->token['callback'];

// Ensure the URL is safe to access
$callback = wp_http_validate_url( $callback );
if ( empty( $callback ) ) {
// wp_http_validate_url is overly restrictive for desktop applications which might use
// 127.0.0.1:xx for the callback. Add hook that allows localhost and check scheme/host of URL.
$filtered_callback = parse_url($callback);
$filtered_callback = $filtered_callback['scheme'] . '://' . $filtered_callback['host'];
add_filter( 'http_request_host_is_external', array('WP_JSON_Authentication_OAuth1_Authorize', 'http_request_allow_external') );
$filtered_callback = wp_http_validate_url( $filtered_callback );
remove_filter( 'http_request_host_is_external', array('WP_JSON_Authentication_OAuth1_Authorize', 'http_request_allow_external') );
if ( empty( $filtered_callback ) ) {
return new WP_Error( 'json_oauth1_invalid_callback', __( 'The callback URL is invalid' ), array( 'status' => 400 ) );
}

Expand All @@ -170,7 +176,16 @@ public function handle_callback_redirect( $verifier ) {

return null;
}


/**
* Allows for local URLs in the OAuth callback.
*
* @return true
*/
public function http_request_allow_external( $allow ) {
return true;
}

/**
* Display an error using login page wrapper
*
Expand Down