sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

REST API: Add support for the REDIRECT_HTTP_AUTHORIZATION header.

Browse Source 
Previously the REST API did not account for server configurations where the Authorization header must be added using ModRewrite. This caused major DUX issues when trying to use custom authentication mechanisms.

Fixes #47077.
Props dshanske, cklosows.


git-svn-id: https://develop.svn.wordpress.org/trunk@47239 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Timothy Jacobs 2020-02-10 16:06:58 +00:00
parent 2c795289c8
commit e7399111b4
2 changed files with 64 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/wp-includes/rest-api/class-wp-rest-server.php
View File

@ -1380,6 +1380,12 @@ class WP_REST_Server {
foreach ( $server as $key => $value ) {
if ( strpos( $key, 'HTTP_' ) === 0 ) {
$headers[ substr( $key, 5 ) ] = $value;
} elseif ( 'REDIRECT_HTTP_AUTHORIZATION' === $key && empty( $server['HTTP_AUTHORIZATION'] ) ) {
/*
* In some server configurations, the authorization header is passed in this alternate location.
* Since it would not be passed in in both places we do not check for both headers and resolve.
*/
$headers['AUTHORIZATION'] = $value;
} elseif ( isset( $additional[ $key ] ) ) {
$headers[ $key ] = $value;
}

58
tests/phpunit/tests/rest-api/rest-server.php
View File

@ -1373,6 +1373,64 @@ class Tests_REST_Server extends WP_Test_REST_TestCase {
$this->assertEquals( '', rest_get_server()->sent_body );
}
/**
* @ticket 47077
*/
public function test_http_authorization_header_substitution() {
$headers = array( 'HTTP_AUTHORIZATION' => 'foo' );
$parsed_headers = rest_get_server()->get_headers( $headers );
$this->assertSame(
array( 'AUTHORIZATION' => 'foo' ),
$parsed_headers
);
}
/**
* @ticket 47077
*/
public function test_redirect_http_authorization_header_substitution() {
$headers = array( 'REDIRECT_HTTP_AUTHORIZATION' => 'foo' );
$parsed_headers = rest_get_server()->get_headers( $headers );
$this->assertSame(
array( 'AUTHORIZATION' => 'foo' ),
$parsed_headers
);
}
/**
* @ticket 47077
*/
public function test_redirect_http_authorization_with_http_authorization_header_substitution() {
$headers = array(
'HTTP_AUTHORIZATION' => 'foo',
'REDIRECT_HTTP_AUTHORIZATION' => 'bar',
);
$parsed_headers = rest_get_server()->get_headers( $headers );
$this->assertSame(
array( 'AUTHORIZATION' => 'foo' ),
$parsed_headers
);
}
/**
* @ticket 47077
*/
public function test_redirect_http_authorization_with_empty_http_authorization_header_substitution() {
$headers = array(
'HTTP_AUTHORIZATION' => '',
'REDIRECT_HTTP_AUTHORIZATION' => 'bar',
);
$parsed_headers = rest_get_server()->get_headers( $headers );
$this->assertSame(
array( 'AUTHORIZATION' => 'bar' ),
$parsed_headers
);
}
public function _validate_as_integer_123( $value, $request, $key ) {
if ( ! is_int( $value ) ) {
return new WP_Error( 'some-error', 'This is not valid!' );