Changeset 50006 for trunk/src/wp-admin/authorize-application.php

Timestamp:

01/24/2021 02:56:18 AM (4 years ago)

Author:

TimothyBlynJacobs

Message:

App Passwords: Extract Basic Auth check into a reusable filterable function.

In [49752] a check was added to prevent creating new Application Passwords if Basic Auth credentials were detected to prevent conflicts. This check takes place in WP-Admin, though a conflict would only arise if Basic Auth was used on the website's front-end.

This commit extracts the Basic Auth check into a reusable function, wp_is_site_protected_by_basic_auth(), which can be adjusted using a filter of the same name. This way, a site that uses Basic Auth to protect WP-Admin can still use the Application Passwords feature.

In the future, instead of requiring the use of a filter, WordPress could make a loopback request and check for a WWW-Authenticate header to make this detection more robust out of the box.

Props SeBsZ, archon810, aaroncampbell, ocean90, SergeyBiryukov, TimothyBlynJacobs.
Fixes #52066.

File:

• trunk/src/wp-admin/authorize-application.php (modified) (1 diff)

trunk/src/wp-admin/authorize-application.php

@@ -89 +89 @@
 }
 
-if ( ! empty( $_SERVER['PHP_AUTH_USER'] ) || ! empty( $_SERVER['PHP_AUTH_PW'] ) ) {
+if ( wp_is_site_protected_by_basic_auth( 'front' ) ) {
     wp_die(
         __( 'Your website appears to use Basic Authentication, which is not currently compatible with Application Passwords.' ),