WordPress.org

Make WordPress Core


Ignore:
Timestamp:
12/04/2020 09:42:52 PM (14 months ago)
Author:
TimothyBlynJacobs
Message:

App Passwords: Prevent conflicts when Basic Auth is already used by the site.

Application Passwords uses Basic Authentication to transfer authentication details. If the site is already using Basic Auth, for instance to implement a private staging environment, then the REST API will treat this as an authentication attempt and would end up generating an error for any REST API request.

Now, Application Password authentication will only be attempted if Application Passwords is in use by a site. This is flagged by setting an option whenever an Application Password is created. An upgrade routine is added to set this option if any App Passwords already exist.

Lastly, creating an Application Password will be prevented if the site appears to already be using Basic Authentication.

Props chexwarrior, georgestephanis, adamsilverstein, helen, Clorith, marybaum, TimothyBlynJacobs.
Fixes #51939.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-admin/includes/upgrade.php

    r49744 r49752  
    875875    }
    876876
    877     if ( $wp_current_db_version < 49735 ) {
     877    if ( $wp_current_db_version < 49752 ) {
    878878        upgrade_560();
    879879    }
     
    22792279        delete_transient( 'dirsize_cache' );
    22802280    }
     2281
     2282    if ( $wp_current_db_version < 49752 ) {
     2283        $results = $wpdb->get_results(
     2284            $wpdb->prepare(
     2285                "SELECT 1 FROM {$wpdb->usermeta} WHERE meta_key = %s LIMIT 1",
     2286                WP_Application_Passwords::USERMETA_KEY_APPLICATION_PASSWORDS
     2287            )
     2288        );
     2289
     2290        if ( ! empty( $results ) ) {
     2291            update_site_option( WP_Application_Passwords::OPTION_KEY_IN_USE, 1 );
     2292        }
     2293    }
    22812294}
    22822295
Note: See TracChangeset for help on using the changeset viewer.