Changeset 49334

Timestamp:

10/27/2020 06:30:03 PM (6 years ago)

Author:

TimothyBlynJacobs

Message:

Site Health, App Passwords: Test if the Authorization header is populated correctly.

App Passwords rely on the Authorization header to transport the Basic Auth credentials. For Apache web servers, WordPress automatically includes a RewriteRule to populate the value for servers running in CGI or FastCGI that wouldn't ordinarily populate the value.

This tests if the header is being filled with the expected values. For Apache users, we direct the user to visit the Permalinks settings to flush their permalinks. For all other users, we direct them to a help document on developer.wordpress.org.

Props Clorith, marybaum, TimothyBlynJacobs.
Fixes #51638.

Location:

trunk

Files:

• src/js/_enqueues/admin/site-health.js (modified) (1 diff)
• src/wp-admin/includes/class-wp-site-health.php (modified) (6 diffs)
• src/wp-includes/rest-api/endpoints/class-wp-rest-site-health-controller.php (modified) (2 diffs)
• tests/phpunit/tests/rest-api/rest-schema-setup.php (modified) (1 diff)

trunk/src/js/_enqueues/admin/site-health.js

@@ -213 +213 @@
                                 if ( 'undefined' !== typeof( this.has_rest ) && this.has_rest ) {
                                         wp.apiRequest( {
-                                                url: this.test
+                                                url: this.test,
+                                                headers: this.headers
                                         } )
                                                 .done( function( response ) {

trunk/src/wp-admin/includes/class-wp-site-health.php

@@ -136 +136 @@
                                                 'has_rest'  => ( isset( $test['has_rest'] ) ? $test['has_rest'] : false ),
                                                 'completed' => false,
+                                                'headers'   => isset( $test['headers'] ) ? $test['headers'] : array(),
                                         );
                                 }
@@ -2074 +2075 @@
                         );
                         return $result;
+                }
+
+                return $result;
+        }
+
+        /**
+         * Tests if the Authorization header has the expected values.
+         *
+         * @since 5.6.0
+         *
+         * @return array
+         */
+        public function get_test_authorization_header() {
+                $result = array(
+                        'label'       => __( 'The Authorization header is working as expected.' ),
+                        'status'      => 'good',
+                        'badge'       => array(
+                                'label' => __( 'Security' ),
+                                'color' => 'blue',
+                        ),
+                        'description' => sprintf(
+                                '<p>%s</p>',
+                                __( 'The Authorization header comes from the third-party applications you approve. Without it, those apps cannot connect to your site.' )
+                        ),
+                        'actions'     => '',
+                        'test'        => 'authorization_header',
+                );
+
+                if ( ! isset( $_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'] ) ) {
+                        $result['label'] = __( 'The authorization header is missing.' );
+                } elseif ( 'user' !== $_SERVER['PHP_AUTH_USER'] || 'pwd' !== $_SERVER['PHP_AUTH_PW'] ) {
+                        $result['label'] = __( 'The authorization header is invalid.' );
+                } else {
+                        return $result;
+                }
+
+                $result['status'] = 'recommended';
+
+                if ( ! function_exists( 'got_mod_rewrite' ) ) {
+                        require_once ABSPATH . 'wp-admin/includes/misc.php';
+                }
+
+                if ( got_mod_rewrite() ) {
+                        $result['actions'] .= sprintf(
+                                '<p><a href="%s">%s</a></p>',
+                                esc_url( admin_url( 'options-permalink.php' ) ),
+                                __( 'Flush permalinks' )
+                        );
+                } else {
+                        $result['actions'] .= sprintf(
+                                '<p><a href="%s" target="_blank" rel="noopener">%s <span class="screen-reader-text">%s</span><span aria-hidden="true" class="dashicons dashicons-external"></span></a></p>',
+                                'https://developer.wordpress.org/rest-api/frequently-asked-questions/#why-is-authentication-not-working',
+                                __( 'Learn how to configure the Authorization header.' ),
+                                /* translators: Accessibility text. */
+                                __( '(opens in a new tab)' )
+                        );
                 }
 
@@ -2178 +2235 @@
                                         'async_direct_test' => array( WP_Site_Health::get_instance(), 'get_test_loopback_requests' ),
                                 ),
+                                'authorization_header' => array(
+                                        'label'     => __( 'Authorization header' ),
+                                        'test'      => rest_url( 'wp-site-health/v1/tests/authorization-header' ),
+                                        'has_rest'  => true,
+                                        'headers'   => array( 'Authorization' => 'Basic ' . base64_encode( 'user:pwd' ) ),
+                                        'skip_cron' => true,
+                                ),
                         ),
                 );
@@ -2204 +2268 @@
                  * @since 5.2.0
                  * @since 5.6.0 Added the `async_direct_test` array key.
+                 *              Added the `skip_cron` array key.
                  *
                  * @param array $test_type {
@@ -2218 +2283 @@
                  *                                           to be called to perform an async test.
                  *         @type boolean  $has_rest          Optional. Denote if `$test` has a REST API endpoint.
+                 *         @type boolean  $skip_cron         Whether to skip this test when running as cron.
                  *         @type callable $async_direct_test A manner of directly calling the test marked as asynchronous,
                  *                                           as the scheduled event can not authenticate, and endpoints
@@ -2558 +2624 @@
 
                 foreach ( $tests['async'] as $test ) {
+                        if ( ! empty( $test['skip_cron'] ) ) {
+                                continue;
+                        }
+
                         // Local endpoints may require authentication, so asynchronous tests can pass a direct test runner as well.
                         if ( ! empty( $test['async_direct_test'] ) && is_callable( $test['async_direct_test'] ) ) {

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-site-health-controller.php

@@ -99 +99 @@
                                         'permission_callback' => function () {
                                                 return $this->validate_request_permission( 'dotorg_communication' );
+                                        },
+                                ),
+                                'schema' => array( $this, 'get_public_item_schema' ),
+                        )
+                );
+
+                register_rest_route(
+                        $this->namespace,
+                        sprintf(
+                                '/%s/%s',
+                                $this->rest_base,
+                                'authorization-header'
+                        ),
+                        array(
+                                array(
+                                        'methods'             => 'GET',
+                                        'callback'            => array( $this, 'test_authorization_header' ),
+                                        'permission_callback' => function () {
+                                                return $this->validate_request_permission( 'authorization_header' );
                                         },
                                 ),
@@ -176 +195 @@
         public function test_loopback_requests() {
                 return $this->site_health->get_test_loopback_requests();
+        }
+
+        /**
+         * Checks that the authorization header is valid.
+         *
+         * @since 5.6.0
+         *
+         * @return array
+         */
+        public function test_authorization_header() {
+                return $this->site_health->get_test_authorization_header();
         }
 

trunk/tests/phpunit/tests/rest-api/rest-schema-setup.php

@@ -137 +137 @@
                         '/wp-site-health/v1/tests/loopback-requests',
                         '/wp-site-health/v1/tests/dotorg-communication',
+                        '/wp-site-health/v1/tests/authorization-header',
                         '/wp-site-health/v1/directory-sizes',
                 );