Changeset 8701

Timestamp:

08/21/2008 05:40:38 PM (17 years ago)

Author:

ryan

Message:

Option to force SSL. see #7561

Location:

trunk

Files:

• wp-admin/includes/user.php (modified) (1 diff)
• wp-admin/user-edit.php (modified) (5 diffs)
• wp-includes/pluggable.php (modified) (1 diff)
• wp-includes/registration.php (modified) (2 diffs)
• wp-login.php (modified) (1 diff)

trunk/wp-admin/includes/user.php

@@ -74 +74 @@
         $user->rich_editing = 'false';
 
+    $user->use_ssl = 0;
+    if ( !empty($_POST['use_ssl']) )
+        $user->use_ssl = 1;
+
     if ( !$update )
         $user->admin_color = 'fresh';  // Default to fresh for new users.

trunk/wp-admin/user-edit.php

@@ -100 +100 @@
 $user_id = (int) $user_id;
 
-if ( !$user_id )
+if ( !$user_id ) {
     if ( $is_profile_page ) {
         $current_user = wp_get_current_user();
@@ -107 +107 @@
         wp_die(__('Invalid user ID.'));
     }
+}
+
+// Optional SSL preference that can be turned on by hooking to the 'personal_options' action 
+function use_ssl_preference($user) {
+?>
+    <tr>
+        <th scope="row"><?php _e('Use https')?></th>
+        <td><label for="use_ssl"><input name="use_ssl" type="checkbox" id="use_ssl" value="1" <?php checked('1', $user->use_ssl); ?> /> <?php _e('Always use https when visiting the admin'); ?></label></td>
+    </tr>
+<?php
+}
 
 switch ($action) {
@@ -130 +141 @@
 $errors = edit_user($user_id);
 
-if( !is_wp_error( $errors ) ) {
+if ( !is_wp_error( $errors ) ) {
     $redirect = ($is_profile_page? "profile.php?" : "user-edit.php?user_id=$user_id&"). "updated=true";
     $redirect = add_query_arg('wp_http_referer', urlencode($wp_http_referer), $redirect);
@@ -141 +152 @@
 
 if ( !current_user_can('edit_user', $user_id) )
-        wp_die(__('You do not have permission to edit this user.'));
+    wp_die(__('You do not have permission to edit this user.'));
 
 include ('admin-header.php');
@@ -210 +221 @@
 </fieldset></td>
 </tr>
-<?php endif; ?>
+<?php
+endif;
+do_action('personal_options', $profileuser);
+?>
 </table>
 <?php
-    if ( $is_profile_page ) {
-        do_action('profile_personal_options');
-    }
+    if ( $is_profile_page )
+        do_action('profile_personal_options', $profileuser);
 ?>
 

trunk/wp-includes/pluggable.php

@@ -704 +704 @@
     }
 
-    if ( wp_validate_auth_cookie() )
+    if ( $user_id = wp_validate_auth_cookie() ) {
+        // If the user wants ssl but the session is not ssl, redirect.
+        if ( !$secure && get_user_option('use_ssl', $user_id) ) {
+            if ( 0 === strpos($_SERVER['REQUEST_URI'], 'http') ) {
+                wp_redirect(preg_replace('|^http://|', 'https://', $_SERVER['REQUEST_URI']));
+                exit();
+            } else {
+                wp_redirect('https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
+                exit();
+            }
+        }
+
         return;  // The cookie is good so we're done
+    }
 
     // The cookie is no good so force login

trunk/wp-includes/registration.php

@@ -159 +159 @@
     $admin_color = preg_replace('|[^a-z0-9 _.\-@]|i', '', $admin_color);
 
+    if ( empty($use_ssl) )
+        $use_ssl = 0;
+
     if ( empty($user_registered) )
         $user_registered = gmdate('Y-m-d H:i:s');
@@ -182 +185 @@
     update_usermeta( $user_id, 'rich_editing', $rich_editing);
     update_usermeta( $user_id, 'admin_color', $admin_color);
+    update_usermeta( $user_id, 'use_ssl', $use_ssl);
 
     if ( $update && isset($role) ) {

trunk/wp-login.php

@@ -408 +408 @@
 case 'login' :
 default:
-    if ( isset( $_REQUEST['redirect_to'] ) )
+    $secure_cookie = '';
+
+    // If the user wants ssl but the session is not ssl, force a secure cookie.
+    if ( !empty($_POST['log']) && !force_ssl_admin() ) {
+        $user_name = sanitize_user($_POST['log']);
+        if ( $user = get_userdatabylogin($user_name) ) {
+            if ( get_user_option('use_ssl', $user->ID) ) {
+                $secure_cookie = true;
+                force_ssl_admin(true);
+            }
+        }
+    }
+
+    if ( isset( $_REQUEST['redirect_to'] ) ) {
         $redirect_to = $_REQUEST['redirect_to'];
-    else
+        // Redirect to https if user wants ssl
+        if ( $secure_cookie )
+            $redirect_to = preg_replace('|^http://|', 'https://', $redirect_to);
+    } else {
         $redirect_to = admin_url();
-
-    if ( is_ssl() && force_ssl_login() && !force_ssl_admin() && ( 0 !== strpos($redirect_to, 'https') ) && ( 0 === strpos($redirect_to, 'http') ) )
+    }
+
+    if ( !$secure_cookie && is_ssl() && force_ssl_login() && !force_ssl_admin() && ( 0 !== strpos($redirect_to, 'https') ) && ( 0 === strpos($redirect_to, 'http') ) )
         $secure_cookie = false;
-    else
-        $secure_cookie = '';
 
     $user = wp_signon('', $secure_cookie);