Changeset 49276

Timestamp:

10/22/2020 03:04:23 PM (4 years ago)

Author:

TimothyBlynJacobs

Message:

App Passwords: Support an app_id to uniquely identify instances of an app.

Apps may now optionally include an app_id parameter when directing the user to the Authorize Application screen. This allows for instances of an application to be identified and potentially revoked or blocked.

Props TimothyBlynJacobs, georgestephanis.
Fixes #51583.

Location:

trunk

Files:

• src/js/_enqueues/admin/auth-app.js (modified) (2 diffs)
• src/wp-admin/authorize-application.php (modified) (5 diffs)
• src/wp-admin/includes/user.php (modified) (2 diffs)
• src/wp-includes/class-wp-application-passwords.php (modified) (1 diff)
• src/wp-includes/rest-api/endpoints/class-wp-rest-application-passwords-controller.php (modified) (3 diffs)
• tests/phpunit/tests/rest-api/rest-application-passwords-controller.php (modified) (7 diffs)
• tests/qunit/fixtures/wp-api-generated.js (modified) (2 diffs)

trunk/src/js/_enqueues/admin/auth-app.js

@@ -17 +17 @@
 
     $approveBtn.click( function( e ) {
-        var name = $appNameField.val();
+        var name = $appNameField.val(),
+            appId = $( 'input[name="app_id"]', $form ).val();
 
         e.preventDefault();
@@ -32 +33 @@
             name: name
         };
+
+
+
+
 
         /**

trunk/src/wp-admin/authorize-application.php

@@ -19 +19 @@
     $reject_url  = $_POST['reject_url'];
     $app_name    = $_POST['app_name'];
+
     $redirect    = '';
 
@@ -28 +29 @@
         }
     } elseif ( isset( $_POST['approve'] ) ) {
-        $created = WP_Application_Passwords::create_new_application_password( get_current_user_id(), array( 'name' => $app_name ) );
+        $created = WP_Application_Passwords::create_new_application_password(
+            get_current_user_id(),
+            array(
+                'name'   => $app_name,
+                'app_id' => $app_id,
+            )
+        );
 
         if ( is_wp_error( $created ) ) {
@@ -57 +64 @@
 
 $app_name    = ! empty( $_REQUEST['app_name'] ) ? $_REQUEST['app_name'] : '';
+
 $success_url = ! empty( $_REQUEST['success_url'] ) ? $_REQUEST['success_url'] : null;
 
@@ -69 +77 @@
 $user = wp_get_current_user();
 
-$request  = compact( 'app_name', 'success_url', 'reject_url' );
+$request  = compact( 'app_name', 'success_url', 'reject_url' );
 $is_valid = wp_is_authorize_application_password_request_valid( $request, $user );
 
@@ -184 +192 @@
                 <?php wp_nonce_field( 'authorize_application_password' ); ?>
                 <input type="hidden" name="action" value="authorize_application_password" />
+
                 <input type="hidden" name="success_url" value="<?php echo esc_url( $success_url ); ?>" />
                 <input type="hidden" name="reject_url" value="<?php echo esc_url( $reject_url ); ?>" />

trunk/src/wp-admin/includes/user.php

@@ -605 +605 @@
  *
  *     @type string $app_name    The suggested name of the application.
+
  *     @type string $success_url The url the user will be redirected to after approving the application.
  *     @type string $reject_url  The url the user will be redirected to after rejecting the application.
@@ -636 +637 @@
     }
 
+
+
+
+
+
+
+
     /**
      * Fires before application password errors are returned.

trunk/src/wp-includes/class-wp-application-passwords.php

@@ -52 +52 @@
         $new_item = array(
             'uuid'      => wp_generate_uuid4(),
+
             'name'      => $args['name'],
             'password'  => $hashed_password,

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-application-passwords-controller.php

@@ -413 +413 @@
         );
 
+
+
+
+
         /**
          * Filters an application password before it is inserted via the REST API.
@@ -442 +446 @@
         $prepared = array(
             'uuid'      => $item['uuid'],
+
             'name'      => $item['name'],
             'created'   => gmdate( 'Y-m-d\TH:i:s', $item['created'] ),
@@ -616 +621 @@
                     'readonly'    => true,
                 ),
+
+
+
+
+
+
                 'name'      => array(
                     'description' => __( 'The name of the application password.' ),

trunk/tests/phpunit/tests/rest-api/rest-application-passwords-controller.php

@@ -309 +309 @@
         wp_set_current_user( self::$admin );
 
+
         $request = new WP_REST_Request( 'POST', '/wp/v2/users/me/application-passwords' );
-        $request->set_body_params( array( 'name' => 'App' ) );
+        $request->set_body_params(
+            array(
+                'name'   => 'App',
+                'app_id' => $app_id,
+            )
+        );
         $response = rest_do_request( $request );
 
@@ -319 +325 @@
         $this->check_response( $response->get_data(), $passwords[0], true );
         $this->assertEquals( 'App', $response->get_data()['name'] );
+
         $this->assertNull( $response->get_data()['last_used'] );
         $this->assertNull( $response->get_data()['last_ip'] );
@@ -512 +519 @@
         $response = rest_do_request( $request );
         $this->assertErrorResponse( 'rest_application_password_not_found', $response, 404 );
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
     }
 
@@ -776 +813 @@
     protected function check_response( $response, $item, $password = false ) {
         $this->assertArrayHasKey( 'uuid', $response );
+
         $this->assertArrayHasKey( 'name', $response );
         $this->assertArrayHasKey( 'created', $response );
@@ -782 +820 @@
 
         $this->assertEquals( $item['uuid'], $response['uuid'] );
+
         $this->assertEquals( $item['name'], $response['name'] );
         $this->assertEquals( gmdate( 'Y-m-d\TH:i:s', $item['created'] ), $response['created'] );
@@ -813 +852 @@
         $properties = $data['schema']['properties'];
 
-        $this->assertCount( 6, $properties );
         $this->assertArrayHasKey( 'uuid', $properties );
+
         $this->assertArrayHasKey( 'name', $properties );
         $this->assertArrayHasKey( 'password', $properties );
@@ -820 +859 @@
         $this->assertArrayHasKey( 'last_used', $properties );
         $this->assertArrayHasKey( 'last_ip', $properties );
+
     }
 }

trunk/tests/qunit/fixtures/wp-api-generated.js

@@ -4918 +4918 @@
                     ],
                     "args": {
+
+
+
+
+
                         "name": {
                             "description": "The name of the application password.",
@@ -4968 +4973 @@
                     ],
                     "args": {
+
+
+
+
+
                         "name": {
                             "description": "The name of the application password.",