Get WordPress

Plugin Directory

Changeset 2942075

Timestamp:
07/23/2023 12:06:42 PM (13 months ago)
Author:
ayeshrajans
Message:

Add v2.0

Location:
samesite
Files:
5 added
3 edited

Legend:

Unmodified
Added
Removed

  • samesite/trunk/composer.json

    r2223251 r2942075  
    88            {
    99                "name": "Ayesh Karunaratne",
    10                 "email": "ayesh@ayesh.me",
    11                 "homepage": "https://ayesh.me"
     10                "email": "ayesh@aye",
     11                "homepage": "https://aye"
    1212            }
    1313        ],
    14     "keywords": ["password", "password_hash", "bcrypt", "argon2", "argon2i", "sodium", "password-security", "security", "wordpress", "wordpress-security", "wordpress-plugin"],
     14    "keywords": ["s", "wordpress-security", "wordpress-plugin"],
    1515    "support": {
    1616        "issues": "https://github.com/phpwatch/WordPress-SameSite/issues"
    1717    },
    1818    "require": {
    19         "php": ">=5.6.0",
     19        "php": ">=.0",
    2020        "composer/installers": "~1.0"
    2121    },

  • samesite/trunk/readme.txt

    r2447747 r2942075  
    22Contributors: ayeshrajans
    33Tags: security, csrf, cookies, samesite
    4 Requires at least: 4.3
    5 Tested up to: 5.6
     4Requires at least:
     5Tested up to:
    66License: GPLv2 or later
    7 Stable tag: 1.5
     7Stable tag: 2.0
     8Requires PHP: 7.0
    89
    910CSRF-protection for authentication cookies. When enabled, this plugin makes sure the "SameSite" flag is set in authentication cookies. SameSite flag on a cookie prevents the browser from sending the cookie (thus, the authentication) on Cross-Site requests. This protects users from Cross-Site Request Forgery attacks.
    … …  
    1415SameSite cookie flag support was added to PHP on version 7.3, but this plugin ships with a workaround to **support all PHP versions** WordPress supports.
    1516
    16 There is no administrative UI provided: Activate this plugin and you are all set!
     17There is no administrative UI provided: Activate this plugin and you are all set!
    1718
    1819You can configure the SameSite flag value from your WordPress configuration file. You cna pick a value from `Lax` (default), `Strict`, or `None`. You can read about [SameSite cookies here](https://php.watch/articles/PHP-Samesite-cookies).
    … …  
    2425```
    2526
    26 Note that only the authentication cookies are affected. Regular cookies that your installed plugins set will **not** be affected, nor provide any meaningful value with `SameSite` flags.
     27Note that . Regular cookies that your installed plugins set will **not** be affected, nor provide any meaningful value with `SameSite` flags.
    2728
    2829== Installation ==
    29301. Install this plugin as you would with any other plugin.
    30312. Enable it.
    31 3. There is no third step - From this point afterwards, authentication cookies your WordPress site uses will contain SameSite flag, and you will be protected from CSRF attacks.
     323. There is no third step - From this point afterward, authentication cookies your WordPress site uses will contain SameSite flag, and you will be protected from CSRF attacks.
    3233
    3334If you find this plugin useful, I'd appreciate you leaving a review on the plugin page.
    3435
    3536== Frequently Asked Questions ==
     37
     38
     39
     40
     41
     42
     43
     44
     45
     46
     47
    3648= Do I need to have PHP 7.3 or later? =
    3749No. [PHP 7.3 officially added SameSite cookie support](https://php.watch/versions/7.3/same-site-cookies), but this plugin comes with a polyfill to extend support to all previous PHP versions.
    … …  
    4153
    4254
     55
     56
     57
     58
    4359== Changelog ==
    4460
    4561= 1.5 =
    4662* Fixes a cookie expiration issue that was reported multiple times in the issue queue. Thanks to Jamie Magin (@jamagin at GitHub).
     63
     64
     65
     66

  • samesite/trunk/samesite.php

    r2447747 r2942075  
    66Plugin Name: SameSite
    77Plugin URI: https://wordpress.org/plugins/samesite
    8 Description: CSRF-protection for authentication cookies. When enable, this plugin makes sure the "SameSite" flag is set in authentication cookies, which protects users from Cross-Site Request Forgery attacks.
    9 Version: 1.5
     8Description: CSRF-protection for authentication cookies. When enable, this plugin makes sure the "SameSite" flag is set in authentication cookies, which protects users from Cross-Site Request Forgery attacks.
     9Version:
    1010Author: Ayesh Karunaratne
    11 Author URI: https://ayesh.me/open-source
     11Author URI: https://aye/open-source
    1212License: GPLv2 or later
    1313*/
    … …  
    3131 * @param string $token    Optional. User's session token to use for this cookie.
    3232 */
    33 function wp_set_auth_cookie( $user_id, $remember = false, $secure = '', $token = '' ) {
     33function wp_set_auth_cookie( $token = '' ) {
    3434    if ( $remember ) {
    3535        /**
    … …  
    5959    }
    6060
    61     // Front-end cookie is secure when the auth cookie is secure and the site's home URL is forced HTTPS.
     61    // Front-end cookie is secure when the auth cookie is secure and the site's home URL HTTPS.
    6262    $secure_logged_in_cookie = $secure && 'https' === parse_url( get_option( 'home' ), PHP_URL_SCHEME );
    6363
    6464    /**
    65      * Filters whether the connection is secure.
     65     * Filters whether the .
    6666     *
    6767     * @since 3.1.0
    … …  
    7777     * @since 3.1.0
    7878     *
    79      * @param bool $secure_logged_in_cookie Whether to use a secure cookie when logged-in.
     79     * @param bool $secure_logged_in_cookie Whether t.
    8080     * @param int  $user_id                 User ID.
    81      * @param bool $secure                  Whether the connection is secure.
     81     * @param bool $secure                  Whether the .
    8282     */
    8383    $secure_logged_in_cookie = apply_filters( 'secure_logged_in_cookie', $secure_logged_in_cookie, $user_id, $secure );
    … …  
    137137     *
    138138     * @since 4.7.4
    139      *
    140      * @param bool $send Whether to send auth cookies to the client.
    141      */
    142     if ( ! apply_filters( 'send_auth_cookies', true ) ) {
     139     * @since 6.2.0 The `$expire`, `$expiration`, `$user_id`, `$scheme`, and `$token` parameters were added.
     140     *
     141     * @param bool   $send       Whether to send auth cookies to the client. Default true.
     142     * @param int    $expire     The time the login grace period expires as a UNIX timestamp.
     143     *                           Default is 12 hours past the cookie's expiration time. Zero when clearing cookies.
     144     * @param int    $expiration The time when the logged-in authentication cookie expires as a UNIX timestamp.
     145     *                           Default is 14 days from now. Zero when clearing cookies.
     146     * @param int    $user_id    User ID. Zero when clearing cookies.
     147     * @param string $scheme     Authentication scheme. Values include 'auth' or 'secure_auth'.
     148     *                           Empty string when clearing cookies.
     149     * @param string $token      User's session token to use for this cookie. Empty string when clearing cookies.
     150     */
     151    if ( ! apply_filters( 'send_auth_cookies', true, $expire, $expiration, $user_id, $scheme, $token ) ) {
    143152        return;
    144153    }
Note: See TracChangeset for help on using the changeset viewer.