Changeset 37905

Timestamp:

06/29/2016 03:00:54 AM (8 years ago)

Author:

rachelbaker

Message:

REST API: Include a refreshed nonce in a X-WP-Nonce header when responding to an authenticated request.

Props adamsilverstein, welcher, markjaquith, aidvu.
Fixes #35662.

Location:

trunk

Files:

• src/wp-includes/rest-api.php (modified) (3 diffs)
• tests/phpunit/tests/rest-api/rest-server.php (modified) (2 diffs)

trunk/src/wp-includes/rest-api.php

@@ -549 +549 @@
  * @since 4.4.0
  *
- * @global mixed $wp_rest_auth_cookie
- *
- * @param WP_Error|mixed $result Error from another authentication handler, null if we should handle it,
- *                               or another value if not.
+ * @global mixed          $wp_rest_auth_cookie
+ * @global WP_REST_Server $wp_rest_server      REST server instance.
+ *
+ * @param WP_Error|mixed $result Error from another authentication handler,
+ *                               null if we should handle it, or another value
+ *                               if not.
  * @return WP_Error|mixed|bool WP_Error if the cookie is invalid, the $result, otherwise true.
  */
@@ -560 +562 @@
     }
 
-    global $wp_rest_auth_cookie;
+    global $wp_rest_auth_cookie, $wp_rest_server;
 
     /*
@@ -593 +595 @@
     }
 
+    // Send a refreshed nonce in header.
+    $wp_rest_server->send_header( 'X-WP-Nonce', wp_create_nonce( 'wp_rest' ) );
+
     return true;
 }

trunk/tests/phpunit/tests/rest-api/rest-server.php

@@ -24 +24 @@
         // Remove our temporary spy server
         $GLOBALS['wp_rest_server'] = null;
+        unset( $_REQUEST['_wpnonce'] );
 
         parent::tearDown();
@@ -894 +895 @@
         return 'Spy_REST_Server';
     }
+
+    /**
+     * Refreshed nonce should not be present in header when an invalid nonce is passed for logged in user.
+     *
+     * @ticket 35662
+     */
+    public function test_rest_send_refreshed_nonce_invalid_nonce() {
+        $this->helper_setup_user_for_rest_send_refreshed_nonce_tests();
+
+        $_REQUEST['_wpnonce'] = 'random invalid nonce';
+
+        $headers = $this->helper_make_request_and_return_headers_for_rest_send_refreshed_nonce_tests();
+
+        $this->assertArrayNotHasKey( 'X-WP-Nonce', $headers );
+    }
+
+    /**
+     * Refreshed nonce should be present in header when a valid nonce is
+     * passed for logged in/anonymous user and not present when nonce is not
+     * passed.
+     *
+     * @ticket 35662
+     *
+     * @dataProvider data_rest_send_refreshed_nonce
+     *
+     * @param bool $has_logged_in_user Will there be a logged in user for this test.
+     * @param bool $has_nonce          Are we passing the nonce.
+     */
+    public function test_rest_send_refreshed_nonce( $has_logged_in_user, $has_nonce ) {
+        if ( true === $has_logged_in_user ) {
+            $this->helper_setup_user_for_rest_send_refreshed_nonce_tests();
+        }
+
+        if ( $has_nonce ) {
+            $_REQUEST['_wpnonce'] = wp_create_nonce( 'wp_rest' );
+        }
+
+        $headers = $this->helper_make_request_and_return_headers_for_rest_send_refreshed_nonce_tests();
+
+        if ( $has_nonce ) {
+            $this->assertArrayHasKey( 'X-WP-Nonce', $headers );
+        } else {
+            $this->assertArrayNotHasKey( 'X-WP-Nonce', $headers );
+        }
+    }
+
+    /**
+     * @return array {
+     *     @type array {
+     *         @type bool $has_logged_in_user Are we registering a user for the test.
+     *         @type bool $has_nonce          Is the nonce passed.
+     *     }
+     * }
+     */
+    function data_rest_send_refreshed_nonce() {
+        return array(
+            array( true, true ),
+            array( true, false ),
+            array( false, true ),
+            array( false, false ),
+        );
+    }
+
+    /**
+     * Helper to setup a users and auth cookie global for the
+     * rest_send_refreshed_nonce related tests.
+     */
+    protected function helper_setup_user_for_rest_send_refreshed_nonce_tests() {
+        $author = self::factory()->user->create( array( 'role' => 'author' ) );
+        wp_set_current_user( $author );
+
+        global $wp_rest_auth_cookie;
+
+        $wp_rest_auth_cookie = true;
+    }
+
+    /**
+     * Helper to make the request and get the headers for the
+     * rest_send_refreshed_nonce related tests.
+     *
+     * @return array
+     */
+    protected function helper_make_request_and_return_headers_for_rest_send_refreshed_nonce_tests() {
+        $request = new WP_REST_Request( 'GET', '/', array() );
+        $result  = $this->server->serve_request( '/' );
+
+        return $this->server->sent_headers;
+    }
 }