Changeset 55283 for trunk/src/wp-admin/includes/user.php

Timestamp:

02/07/2023 05:43:55 PM (22 months ago)

Author:

johnbillion

Message:

Application Passwords: Allow plain HTTP success and reject URLs when using a local environment type.

It's not uncommon for local environments to run over HTTP due to the relative complexity of configuring HTTPS for a local environment. This change allows HTTP URLs for application password responses when that is the case.

Props peterwilsoncc, wppunk, cadic, viralsampat

Fixes #52617

File:

• trunk/src/wp-admin/includes/user.php (modified) (3 diffs)

trunk/src/wp-admin/includes/user.php

@@ -613 +613 @@
  *
  * @since 5.6.0
+ * @since 6.2.0 Allow insecure HTTP connections for the local environment.
  *
  * @param array   $request {
@@ -626 +627 @@
  */
 function wp_is_authorize_application_password_request_valid( $request, $user ) {
-    $error = new WP_Error();
+    $error    = new WP_Error();
+    $is_local = 'local' === wp_get_environment_type();
 
     if ( ! empty( $request['success_url'] ) ) {
         $scheme = wp_parse_url( $request['success_url'], PHP_URL_SCHEME );
 
-        if ( 'http' === $scheme ) {
+        if ( 'http' === $scheme && ! $is_local ) {
             $error->add(
                 'invalid_redirect_scheme',
@@ -642 +644 @@
         $scheme = wp_parse_url( $request['reject_url'], PHP_URL_SCHEME );
 
-        if ( 'http' === $scheme ) {
+        if ( 'http' === $scheme && ! $is_local ) {
             $error->add(
                 'invalid_redirect_scheme',