Changeset 28609

Timestamp:

05/29/2014 03:58:41 AM (10 years ago)

Author:

nacin

Message:

Forcing SSL logins now forces SSL for the entire admin, with no middle ground.

fixes #10267.

Location:

trunk

Files:

• src/wp-includes/default-constants.php (modified) (1 diff)
• src/wp-includes/functions.php (modified) (2 diffs)
• src/wp-includes/link-template.php (modified) (1 diff)
• src/wp-login.php (modified) (1 diff)
• tests/phpunit/tests/url.php (modified) (2 diffs)

trunk/src/wp-includes/default-constants.php

@@ -248 +248 @@
      * @since 2.6.0
      */
-    if ( !defined('FORCE_SSL_ADMIN') )
-        define('FORCE_SSL_ADMIN', false);
-    force_ssl_admin(FORCE_SSL_ADMIN);
-
-    /**
-     * @since 2.6.0
-     */
-    if ( !defined('FORCE_SSL_LOGIN') )
-        define('FORCE_SSL_LOGIN', false);
-    force_ssl_login(FORCE_SSL_LOGIN);
+    if ( !defined( 'FORCE_SSL_ADMIN' ) )
+        define( 'FORCE_SSL_ADMIN', false );
+    force_ssl_admin( FORCE_SSL_ADMIN );
+
+    /**
+     * @since 2.6.0
+     * @deprecated 4.0.0
+     */
+    if ( defined( 'FORCE_SSL_LOGIN' ) && FORCE_SSL_LOGIN ) {
+        force_ssl_admin( true );
+    }
 }
 

trunk/src/wp-includes/functions.php

@@ -3388 +3388 @@
  */
 function force_ssl_login( $force = null ) {
-    static $forced = false;
-
-    if ( !is_null( $force ) ) {
-        $old_forced = $forced;
-        $forced = $force;
-        return $old_forced;
-    }
-
-    return $forced;
+    return force_ssl_admin( $force );
 }
 
@@ -4306 +4298 @@
     $same_domain = ( strpos( $login_url, $current_domain ) === 0 );
 
-    if ( $same_domain && force_ssl_login() && ! force_ssl_admin() )
-        $same_domain = false;
-
     /**
      * Filter whether the authentication check originated at the same domain.

trunk/src/wp-includes/link-template.php

@@ -2846 +2846 @@
 function set_url_scheme( $url, $scheme = null ) {
     $orig_scheme = $scheme;
-    if ( ! in_array( $scheme, array( 'http', 'https', 'relative' ) ) ) {
-        if ( ( 'login_post' == $scheme || 'rpc' == $scheme ) && ( force_ssl_login() || force_ssl_admin() ) )
-            $scheme = 'https';
-        elseif ( ( 'login' == $scheme ) && force_ssl_admin() )
-            $scheme = 'https';
-        elseif ( ( 'admin' == $scheme ) && force_ssl_admin() )
-            $scheme = 'https';
-        else
-            $scheme = ( is_ssl() ? 'https' : 'http' );
+
+    if ( ! $scheme ) {
+        $scheme = is_ssl() ? 'https' : 'http';
+    } elseif ( $scheme === 'admin' || $scheme === 'login' || $scheme === 'login_post' || $scheme === 'rpc' ) {
+        $scheme = is_ssl() || force_ssl_admin() ? 'https' : 'http';
+    } elseif ( $scheme !== 'http' && $scheme !== 'https' && $scheme !== 'relative' ) {
+        $scheme = is_ssl() ? 'https' : 'http';
     }
 

trunk/src/wp-login.php

@@ -742 +742 @@
     $reauth = empty($_REQUEST['reauth']) ? false : true;
 
-    // If the user was redirected to a secure login form from a non-secure admin page, and secure login is required but secure admin is not, then don't use a secure
-    // cookie and redirect back to the referring non-secure admin page. This allows logins to always be POSTed over SSL while allowing the user to choose visiting
-    // the admin via http or https.
-    if ( !$secure_cookie && is_ssl() && force_ssl_login() && !force_ssl_admin() && ( 0 !== strpos($redirect_to, 'https') ) && ( 0 === strpos($redirect_to, 'http') ) )
-        $secure_cookie = false;
-
     $user = wp_signon( '', $secure_cookie );
 

trunk/tests/phpunit/tests/url.php

@@ -2 +2 @@
 
 // tests for link-template.php and related URL functions
+/**
+ * @group url
+ */
 class Tests_URL extends WP_UnitTestCase {
     var $_old_server;
@@ -265 +268 @@
 
             force_ssl_login( true );
-            $this->assertEquals( $http_links[ $i ], set_url_scheme( $link, 'admin' ) );
+            $this->assertEquals( $https_links[ $i ], set_url_scheme( $link, 'admin' ) );
             $this->assertEquals( $https_links[ $i ], set_url_scheme( $link, 'login_post' ) );
-            $this->assertEquals( $http_links[ $i ], set_url_scheme( $link, 'login' ) );
+            $this->assertEquals( $https_links[ $i ], set_url_scheme( $link, 'login' ) );
             $this->assertEquals( $https_links[ $i ], set_url_scheme( $link, 'rpc' ) );