Changeset 50044 for branches/5.6/src/wp-admin/authorize-application.php

Timestamp:

01/28/2021 12:27:13 AM (5 years ago)

Author:

whyisjake

Message:

App Passwords: Extract Basic Auth check into a reusable filterable function.

In [49752] a check was added to prevent creating new Application Passwords if Basic Auth credentials were detected to prevent conflicts. This check takes place in WP-Admin, though a conflict would only arise if Basic Auth was used on the website's front-end.

This commit extracts the Basic Auth check into a reusable function, wp_is_site_protected_by_basic_auth(), which can be adjusted using a filter of the same name. This way, a site that uses Basic Auth to protect WP-Admin can still use the Application Passwords feature.

In the future, instead of requiring the use of a filter, WordPress could make a loopback request and check for a WWW-Authenticate header to make this detection more robust out of the box.

This brings the changes from [50006] to the 5.6 branch.

Props SeBsZ, archon810, aaroncampbell, ocean90, SergeyBiryukov, TimothyBlynJacobs.

Fixes #52066.

Location:

branches/5.6

Files:

• . (modified) (1 prop)
• src/wp-admin/authorize-application.php (modified) (1 diff)

branches/5.6/src/wp-admin/authorize-application.php

@@ -89 +89 @@
 }
 
-if ( ! empty( $_SERVER['PHP_AUTH_USER'] ) || ! empty( $_SERVER['PHP_AUTH_PW'] ) ) {
+if ( wp_is_site_protected_by_basic_auth( 'front' ) ) {
     wp_die(
         __( 'Your website appears to use Basic Authentication, which is not currently compatible with Application Passwords.' ),