Changeset 8701

Timestamp:

08/21/2008 05:40:38 PM (18 years ago)

Author:

ryan

Message:

Option to force SSL. see #7561

Location:

trunk

Files:

• wp-admin/includes/user.php (modified) (1 diff)
• wp-admin/user-edit.php (modified) (5 diffs)
• wp-includes/pluggable.php (modified) (1 diff)
• wp-includes/registration.php (modified) (2 diffs)
• wp-login.php (modified) (1 diff)

trunk/wp-admin/includes/user.php

@@ -74 +74 @@
                 $user->rich_editing = 'false';
 
+        $user->use_ssl = 0;
+        if ( !empty($_POST['use_ssl']) )
+                $user->use_ssl = 1;
+
         if ( !$update )
                 $user->admin_color = 'fresh';  // Default to fresh for new users.

trunk/wp-admin/user-edit.php

@@ -100 +100 @@
 $user_id = (int) $user_id;
 
-if ( !$user_id )
+if ( !$user_id ) {
         if ( $is_profile_page ) {
                 $current_user = wp_get_current_user();
@@ -107 +107 @@
                 wp_die(__('Invalid user ID.'));
         }
+}
+
+// Optional SSL preference that can be turned on by hooking to the 'personal_options' action 
+function use_ssl_preference($user) {
+?>
+        <tr>
+                <th scope="row"><?php _e('Use https')?></th>
+                <td><label for="use_ssl"><input name="use_ssl" type="checkbox" id="use_ssl" value="1" <?php checked('1', $user->use_ssl); ?> /> <?php _e('Always use https when visiting the admin'); ?></label></td>
+        </tr>
+<?php
+}
 
 switch ($action) {
@@ -130 +141 @@
 $errors = edit_user($user_id);
 
-if( !is_wp_error( $errors ) ) {
+if ( !is_wp_error( $errors ) ) {
         $redirect = ($is_profile_page? "profile.php?" : "user-edit.php?user_id=$user_id&"). "updated=true";
         $redirect = add_query_arg('wp_http_referer', urlencode($wp_http_referer), $redirect);
@@ -141 +152 @@
 
 if ( !current_user_can('edit_user', $user_id) )
-                wp_die(__('You do not have permission to edit this user.'));
+        wp_die(__('You do not have permission to edit this user.'));
 
 include ('admin-header.php');
@@ -210 +221 @@
 </fieldset></td>
 </tr>
-<?php endif; ?>
+<?php
+endif;
+do_action('personal_options', $profileuser);
+?>
 </table>
 <?php
-        if ( $is_profile_page ) {
-                do_action('profile_personal_options');
-        }
+        if ( $is_profile_page )
+                do_action('profile_personal_options', $profileuser);
 ?>
 

trunk/wp-includes/pluggable.php

@@ -704 +704 @@
         }
 
-        if ( wp_validate_auth_cookie() )
+        if ( $user_id = wp_validate_auth_cookie() ) {
+                // If the user wants ssl but the session is not ssl, redirect.
+                if ( !$secure && get_user_option('use_ssl', $user_id) ) {
+                        if ( 0 === strpos($_SERVER['REQUEST_URI'], 'http') ) {
+                                wp_redirect(preg_replace('|^http://|', 'https://', $_SERVER['REQUEST_URI']));
+                                exit();
+                        } else {
+                                wp_redirect('https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
+                                exit();
+                        }
+                }
+
                 return;  // The cookie is good so we're done
+        }
 
         // The cookie is no good so force login

trunk/wp-includes/registration.php

@@ -159 +159 @@
         $admin_color = preg_replace('|[^a-z0-9 _.\-@]|i', '', $admin_color);
 
+        if ( empty($use_ssl) )
+                $use_ssl = 0;
+
         if ( empty($user_registered) )
                 $user_registered = gmdate('Y-m-d H:i:s');
@@ -182 +185 @@
         update_usermeta( $user_id, 'rich_editing', $rich_editing);
         update_usermeta( $user_id, 'admin_color', $admin_color);
+        update_usermeta( $user_id, 'use_ssl', $use_ssl);
 
         if ( $update && isset($role) ) {

trunk/wp-login.php

@@ -408 +408 @@
 case 'login' :
 default:
-        if ( isset( $_REQUEST['redirect_to'] ) )
+        $secure_cookie = '';
+
+        // If the user wants ssl but the session is not ssl, force a secure cookie.
+        if ( !empty($_POST['log']) && !force_ssl_admin() ) {
+                $user_name = sanitize_user($_POST['log']);
+                if ( $user = get_userdatabylogin($user_name) ) {
+                        if ( get_user_option('use_ssl', $user->ID) ) {
+                                $secure_cookie = true;
+                                force_ssl_admin(true);
+                        }
+                }
+        }
+
+        if ( isset( $_REQUEST['redirect_to'] ) ) {
                 $redirect_to = $_REQUEST['redirect_to'];
-        else
+                // Redirect to https if user wants ssl
+                if ( $secure_cookie )
+                        $redirect_to = preg_replace('|^http://|', 'https://', $redirect_to);
+        } else {
                 $redirect_to = admin_url();
-
-        if ( is_ssl() && force_ssl_login() && !force_ssl_admin() && ( 0 !== strpos($redirect_to, 'https') ) && ( 0 === strpos($redirect_to, 'http') ) )
+        }
+
+        if ( !$secure_cookie && is_ssl() && force_ssl_login() && !force_ssl_admin() && ( 0 !== strpos($redirect_to, 'https') ) && ( 0 === strpos($redirect_to, 'http') ) )
                 $secure_cookie = false;
-        else
-                $secure_cookie = '';
 
         $user = wp_signon('', $secure_cookie);