Changeset 52398

Timestamp:

12/21/2021 02:43:18 AM (21 months ago)

Author:

hellofromTonya

Message:

Application Passwords: Show HTTPS required message without filtering when not enabled or not in local environment.

When add_filter( 'wp_is_application_passwords_available', '__return_false' ) exists, HTTPS requirement message is shown even if HTTPS is enabled on the site. This happens because wp_is_application_passwords_available_for_user() first invokes wp_is_application_passwords_available() which is filterable. The situation could happen if the 'wp_is_application_passwords_available_for_user' filter returns false.

To fix this, the check for HTTPS (or if in a 'local' environment) is moved to a new function called wp_is_application_passwords_supported(). Then the return from this function is used as an OR condition for the Application Passwords section and for displaying the HTTPS required message.

Tests are included for both wp_is_application_passwords_supported() and wp_is_application_passwords_available().

Follow-up to [51980], [51988].

Props davidbinda, SergeyBiryukov, ocean90, felipeelia, costdev, hellofromTonya.
Fixes #53658.

Location:

trunk

Files:

• src/wp-admin/user-edit.php (modified) (3 diffs)
• src/wp-includes/load.php (modified) (1 diff)
• src/wp-includes/user.php (modified) (3 diffs)
• tests/phpunit/tests/rest-api/rest-application-passwords-controller.php (modified) (1 diff)
• tests/qunit/fixtures/wp-api-generated.js (modified) (1 diff)

trunk/src/wp-admin/user-edit.php

@@ -734 +734 @@
     </table>
 
+<?php if ( wp_is_application_passwords_available_for_user( $user_id ) || ! wp_is_application_passwords_supported() ) : // phpcs:disable Generic.WhiteSpace.ScopeIndent ?>
     <div class="application-passwords hide-if-no-js" id="application-passwords-section">
         <h2><?php _e( 'Application Passwords' ); ?></h2>
@@ -797 +798 @@
             ?>
         </div>
-        <?php else : ?>
+        <?php elseif ( ! wp_is_application_passwords_supported() ) : ?>
             <p><?php _e( 'The application password feature requires HTTPS, which is not enabled on this site.' ); ?></p>
             <p>
@@ -810 +811 @@
         <?php endif; ?>
     </div>
+<?php endif; // phpcs:enable Generic.WhiteSpace.ScopeIndent ?>
 
         <?php

trunk/src/wp-includes/load.php

@@ -192 +192 @@
     static $current_env = '';
 
-    if ( $current_env ) {
+    if ( ! defined( 'WP_RUN_CORE_TESTS' ) && $current_env ) {
         return $current_env;
     }

trunk/src/wp-includes/user.php

@@ -4659 +4659 @@
 
 /**
+ * Checks if Application Passwords is supported.
+ *
+ * Application Passwords is supported only by sites using SSL or local environments
+ * but may be made available using the {@see 'wp_is_application_passwords_available'} filter.
+ *
+ * @since 5.9.0
+ *
+ * @return bool
+ */
+function wp_is_application_passwords_supported() {
+    return is_ssl() || 'local' === wp_get_environment_type();
+}
+
+/**
  * Checks if Application Passwords is globally available.
  *
  * By default, Application Passwords is available to all sites using SSL or to local environments.
- * Use {@see 'wp_is_application_passwords_available'} to adjust its availability.
+ * Use the {@see 'wp_is_application_passwords_available'} filter to adjust its availability.
  *
  * @since 5.6.0
@@ -4669 +4683 @@
  */
 function wp_is_application_passwords_available() {
-    $available = is_ssl() || 'local' === wp_get_environment_type();
-
     /**
      * Filters whether Application Passwords is available.
@@ -4678 +4690 @@
      * @param bool $available True if available, false otherwise.
      */
-    return apply_filters( 'wp_is_application_passwords_available', $available );
+    return apply_filters( 'wp_is_application_passwords_available', wp_is_application_passwords_supported() );
 }
 

trunk/tests/phpunit/tests/rest-api/rest-application-passwords-controller.php

@@ -948 +948 @@
 
     /**
+     * @ticket 53658
+     *
+     * @covers ::wp_is_application_passwords_supported
+     */
+    public function test_wp_is_application_passwords_supported_with_https_only() {
+        $_SERVER['HTTPS'] = 'on';
+        $this->assertTrue( wp_is_application_passwords_supported() );
+    }
+
+    /**
+     * @ticket 53658
+     *
+     * @covers ::wp_is_application_passwords_supported
+     */
+    public function test_wp_is_application_passwords_supported_with_local_environment_only() {
+        putenv( 'WP_ENVIRONMENT_TYPE=local' );
+
+        $actual = wp_is_application_passwords_supported();
+
+        // Revert to default behaviour so that other tests are not affected.
+        putenv( 'WP_ENVIRONMENT_TYPE' );
+
+        $this->assertTrue( $actual );
+    }
+
+    /**
+     * @dataProvider data_wp_is_application_passwords_available
+     *
+     * @ticket 53658
+     *
+     * @covers ::wp_is_application_passwords_available
+     *
+     * @param bool|string $expected The expected value.
+     * @param string|null $callback Optional. The callback for the `wp_is_application_passwords_available` hook.
+     *                              Default: null.
+     */
+    public function test_wp_is_application_passwords_available( $expected, $callback = null ) {
+        remove_filter( 'wp_is_application_passwords_available', '__return_true' );
+
+        if ( $callback ) {
+            add_filter( 'wp_is_application_passwords_available', $callback );
+        }
+
+        if ( 'default' === $expected ) {
+            putenv( 'WP_ENVIRONMENT_TYPE=local' );
+            $expected = wp_is_application_passwords_supported();
+        }
+
+        $actual = wp_is_application_passwords_available();
+
+        if ( 'default' === $expected ) {
+            // Revert to default behaviour so that other tests are not affected.
+            putenv( 'WP_ENVIRONMENT_TYPE' );
+        }
+
+        $this->assertSame( $expected, $actual );
+    }
+
+    /**
+     * Data provider.
+     *
+     * @return array
+     */
+    public function data_wp_is_application_passwords_available() {
+        return array(
+            'availability not forced'   => array(
+                'expected' => 'default',
+            ),
+            'availability forced true'  => array(
+                'expected' => true,
+                'callback' => '__return_true',
+            ),
+            'availability forced false' => array(
+                'expected' => false,
+                'callback' => '__return_false',
+            ),
+        );
+    }
+
+    /**
      * Sets up a REST API request to be authenticated using an App Password.
      *

trunk/tests/qunit/fixtures/wp-api-generated.js

@@ -19 +19 @@
         "wp-block-editor/v1"
     ],
-    "authentication": [],
+    "authentication": {
+        "application-passwords": {
+            "endpoints": {
+                "authorization": "http://example.org/wp-admin/authorize-application.php"
+            }
+        }
+    },
     "routes": {
         "/": {