WordPress.org
Get WordPress

Plugin Directory

Changeset 3489680


Ignore:
Timestamp:
03/24/2026 07:29:51 AM (7 days ago)
Author:
teamwpminiorange
Message:

Release OAuth sso v6.26.18

Location:
miniorange-login-with-eve-online-google-facebook
Files:
356 added
7 edited

Legend:

Unmodified
Added
Removed

  • miniorange-login-with-eve-online-google-facebook/trunk/admin/partials/apps/partials/defaultapps.json

    r3331464 r3489680  
    133133        "label":"battle.net", "type":"oauth", "image":"battlenet.png", "scope": "openid", "domain":"", "discovery":"", "authorize": "https://oauth.battle.net/authorize", "token": "https://oauth.battle.net/token", "userinfo": "https://oauth.battle.net/userinfo", "guide":"", "logo_class":"fa fa-lock", "video":"", "send_header":"1", "send_body":"0"
    134134    },
     135    "imisCloud": {
     136        "label":"iMIS Cloud", "type":"oauth", "image":"imiscloud.png", "scope": "openid email profile", "domain": "", "discovery":"", "authorize": "https://{your-domain}/openid/authenticate", "token": "https://{your-domain}/openid/token", "userinfo": "https://{your-domain}/openid/userinfo", "guide":"https://plugins.miniorange.com/imis-oauth-and-openid-connect-single-sign-on-sso", "logo_class":"fa fa-lock"
     137    , "video":"", "send_header":"1", "send_body":"0"
     138    },
    135139    "gapps": {
    136140        "label":"Google", "type":"openidconnect", "image":"google.png", "scope": "openid profile email", "domain":"", "avl_domain":"", "discovery":"", "authorize": "https://accounts.google.com/o/oauth2/auth", "token": "https://www.googleapis.com/oauth2/v4/token", "userinfo": "https://www.googleapis.com/oauth2/v1/userinfo", "guide":"https://plugins.miniorange.com/google-single-sign-on-wordpress-sso-oauth-openid-connect", "logo_class":"fa fa-google-plus"

  • miniorange-login-with-eve-online-google-facebook/trunk/class-mo-oauth-utils.php

    r3399223 r3489680  
    4444
    4545        $context = stream_context_create( $context_options );
    46         $client  = @stream_socket_client(
     46
     47        // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- stream_socket_client() can emit warnings on expected SSL/connection failures; failure is handled via false and $errno/$errstr.
     48        $client = @stream_socket_client(
    4749            "ssl://{$host}:{$port}",
    4850            $errno,
    … …  
    5456
    5557        if ( false === $client ) {
     58            if ( class_exists( 'MOOAuth_Debug' ) && ( 0 !== $errno || '' !== $errstr ) ) {
     59                MOOAuth_Debug::mo_oauth_log(
     60                    sprintf(
     61                        'SSL Certificate Check: Connection failed. errno: %d, errstr: %s',
     62                        $errno,
     63                        $errstr
     64                    )
     65                );
     66            }
    5667            return false;
    5768        }

  • miniorange-login-with-eve-online-google-facebook/trunk/class-mooauth-widget.php

    r3399223 r3489680  
    100100     */
    101101    public function mo_oauth_start_session() {
    102         if ( ! session_id() && ! mooauth_client_is_ajax_request() && ! mooauth_client_is_rest_api_call() ) {
    103             @session_start();
     102        if ( session_status() === PHP_SESSION_NONE && ! mooauth_client_is_ajax_request() && ! mooauth_client_is_rest_api_call() ) {
     103            $session_path = session_save_path();
     104            if ( empty( $session_path ) ) {
     105                $session_path = sys_get_temp_dir();
     106            }
     107
     108            if ( is_writable( $session_path ) ) {
     109                session_start();
     110            }
    104111        }
    105112
    … …  
    116123     */
    117124    public function mo_oauth_end_session() {
    118         if ( ! session_id() ) {
    119             @session_start();
    120         }
    121         @session_destroy();
     125        if ( session_status() === PHP_SESSION_NONE ) {
     126
     127            $session_path = session_save_path();
     128            if ( empty( $session_path ) ) {
     129                $session_path = sys_get_temp_dir();
     130            }
     131
     132            if ( is_writable( $session_path ) ) {
     133                session_start();
     134            }
     135        }
     136
     137        if ( session_status() === PHP_SESSION_ACTIVE ) {
     138            session_destroy();
     139        }
    122140    }
    123141
    … …  
    347365                }
    348366
    349                 if ( session_id() === '' || ! isset( $_SESSION ) ) {
    350                     @session_start();
     367                if ( session_status() === PHP_SESSION_NONE ) {
     368
     369                    $session_path = session_save_path();
     370                    if ( empty( $session_path ) ) {
     371                        $session_path = sys_get_temp_dir();
     372                    }
     373
     374                    if ( is_writable( $session_path ) ) {
     375                        session_start();
     376                    }
    351377                }
    352378                $_SESSION['oauth2state'] = $state_cookie;
    … …  
    376402                    )
    377403                );
    378                 if ( session_id() === '' || ! isset( $_SESSION ) ) {
    379                     @session_start();
     404                if ( session_status() === PHP_SESSION_NONE ) {
     405                    $session_path = session_save_path();
     406                    if ( empty( $session_path ) ) {
     407                        $session_path = sys_get_temp_dir();
     408                    }
     409
     410                    if ( is_writable( $session_path ) ) {
     411                        session_start();
     412                    }
    380413                }
    381414                $_SESSION['oauth2state'] = $state_cookie;
    … …  
    523556        }
    524557    } elseif ( ( strpos( sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ), '/wp-json/moserver/token' ) === false && ! isset( $_SERVER['HTTP_X_REQUESTED_WITH'] ) && ( strpos( sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ), '/oauthcallback' ) !== false || isset( $_REQUEST['code'] ) ) ) || ( ! empty( $_SERVER['REQUEST_URI'] ) && strpos( sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ), 'openid.ns' ) !== false ) ) { //phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Ignoring nonce verification because we are fetching data from URL and not on form submission.
    525         if ( session_id() === '' || ! isset( $_SESSION ) ) {
    526             @session_start();
     558        if ( session_status() === PHP_SESSION_NONE ) {
     559
     560            $session_path = session_save_path();
     561            if ( empty( $session_path ) ) {
     562                $session_path = sys_get_temp_dir();
     563            }
     564
     565            if ( is_writable( $session_path ) ) {
     566                session_start();
     567            }
    527568        }
    528569        MOOAuth_Debug::mo_oauth_log( 'OAuth plugin catched the flow, $_REQUEST array=>' );
    … …  
    553594                        MOOAuth_Debug::mo_oauth_log( 'Send State Value: ' );
    554595                        MOOAuth_Debug::mo_oauth_log( $app['send_state'] );
    555                         if ( isset( $app['send_state'] ) && $app['send_state'] == true ) {
     596                        if ( isset( $app['send_state'] ) && true == $app['send_state'] ) {
    556597                            $state_required = true;
    557598                            break;
    … …  
    828869    $user_create_response = wp_create_user( $username, $random_password, $email );
    829870    if ( is_wp_error( $user_create_response ) ) {
    830         wp_die( esc_attr( $user_create_response ) );
     871        wp_die( esc_html( $user_create_response->get_error_message() ) );
    831872    }
    832873
    … …  
    10401081        $ipaddress = 'UNKNOWN';
    10411082    }
     1083
     1084    $ips       = array_map( 'trim', explode( ',', $ipaddress ) );
     1085    $ipaddress = $ips[0];
     1086
    10421087    return $ipaddress;
    10431088}

  • miniorange-login-with-eve-online-google-facebook/trunk/class-mooauth.php

    r3399223 r3489680  
    2929        add_action( 'admin_init', array( $this, 'mo_oauth_debug_log_ajax_hook' ) );
    3030        add_action( 'admin_init', array( $this, 'mo_oauth_client_support_script_hook' ) );
     31    }
     32
     33    /**
     34     * Sanitize log file content by stripping HTML tags while preserving plain text like "=>".
     35     *
     36     * @param string $content The log file content to sanitize.
     37     * @return string Sanitized content with HTML tags removed but plain text preserved.
     38     */
     39    private function mo_oauth_sanitize_log_content( $content ) {
     40        $sanitized = wp_kses( $content, array() );
     41        $decoded = html_entity_decode( $sanitized, ENT_QUOTES | ENT_HTML5, 'UTF-8' );
     42
     43        return $decoded;
    3144    }
    3245
    … …  
    459472            global $wp_filesystem;
    460473
     474            $file_contents = $wp_filesystem->get_contents( $mo_filepath );
     475            $sanitized_content = $this->mo_oauth_sanitize_log_content( $file_contents );
     476            $content_length = strlen( $sanitized_content );
     477
    461478            header( 'Content-Description: File Transfer' );
    462479            header( 'Content-Type: text/plain' );
    … …  
    466483            header( 'Cache-Control: must-revalidate' );
    467484            header( 'Pragma: public' );
    468             header( 'Content-Length: ' . filesize( $mo_filepath ) );
    469 
    470             // Output the file contents using WP_Filesystem.
    471             echo esc_html( $wp_filesystem->get_contents( $mo_filepath ) );
     485            header( 'Content-Length: ' . $content_length );
     486
     487            // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Output is sanitized with wp_kses in mo_oauth_sanitize_log_content().
     488            echo $sanitized_content;
    472489            ob_flush();
    473490            flush();

  • miniorange-login-with-eve-online-google-facebook/trunk/handler/class-mo-oauth-handler.php

    r3399223 r3489680  
    206206        if ( is_wp_error( $response ) ) {
    207207            MOOAuth_Debug::mo_oauth_log( 'Invalid response recieved while fetching resource owner details' );
    208             MOOAuth_Debug::mo_oauth_log( $response );
    209             wp_die( esc_html( $response ) );
     208            MOOAuth_Debug::mo_oauth_log( $response->get_error_message() );
     209            wp_die( esc_html( $response->get_error_message() ) );
    210210        }
    211211

  • miniorange-login-with-eve-online-google-facebook/trunk/mo_oauth_settings.php

    r3419722 r3489680  
    1313 * Plugin URI: https://www.miniorange.com
    1414 * Description: This WordPress Single Sign-On plugin allows login into WordPress with your Azure AD B2C, AWS Cognito, Salesforce, Keycloak, Discord, WordPress or other custom OAuth 2.0 / OpenID Connect providers. WordPress OAuth Client plugin works with any Identity provider that conforms to the OAuth 2.0 and OpenID Connect (OIDC) 1.0 standard.
    15  * Version: 6.26.17
     15 * Version: 6.26.18
    1616 * Author: miniOrange
    1717 * Author URI: https://www.miniorange.com
    … …  
    3737require 'admin' . DIRECTORY_SEPARATOR . 'partials' . DIRECTORY_SEPARATOR . 'mo_plugins' . DIRECTORY_SEPARATOR . 'autoload.php';
    3838require_once 'class-mooauth.php';
    39 define( 'MO_OAUTH_CSS_JS_VERSION', '6.26.17' );
     39define( 'MO_OAUTH_CSS_JS_VERSION', '6.26.18' );
    4040define( 'MO_OAUTH_PLUGIN_BASENAME', plugin_basename( __FILE__ ) );
    4141

  • miniorange-login-with-eve-online-google-facebook/trunk/readme.txt

    r3419722 r3489680  
    55Tested up to: 6.9
    66Requires PHP: 7.0
    7 Stable tag: 6.26.17
     7Stable tag: 6.26.18
    88License: Expat
    99License URI: https://plugins.miniorange.com/mit-license
    … …  
    121121
    122122**Ping Federate SSO**
    123 Oauth Single sign-on plugin enables Login to WordPress using PingFederate. It supports Single Sign-On  with authorized access to Ping REST APIs via access tokens or bearer tokens, ensuring seamless SSO integration and secure interactions with PingFederate.
     123OAuth Single sign-on plugin enables Login to WordPress using PingFederate. It supports Single Sign-On  with authorized access to Ping REST APIs via access tokens or bearer tokens, ensuring seamless SSO integration and secure interactions with PingFederate.
    124124
    125125**Clever SSO**
    126 Oauth Single sign-on plugin supports WordPress Login with Clever for users (teachers, students, admins) and integrates with LearnDash to sync lessons and assignments. It also provides SSO with other IDPs like ClassLink, Google Classroom, and Canvas, as well as any Identity Provider (SAML, OAuth, OpenID Connect, Active Directory, databases) via miniOrange IDP.
     126OAuth Single sign-on plugin supports WordPress Login with Clever for users (teachers, students, admins) and integrates with LearnDash to sync lessons and assignments. It also provides SSO with other IDPs like ClassLink, Google Classroom, and Canvas, as well as any Identity Provider (SAML, OAuth, OpenID Connect, Active Directory, databases) via miniOrange IDP.
    127127
    128128
    … …  
    212212
    213213== Changelog ==
     214= 6.26.18 =
     215* Fixed client IP detection in multi-proxy setups
     216* Fixed error when configuring an invalid UserInfo endpoint
     217* Fixed Debug log unexpected character issue.
     218
    214219= 6.26.17 =
    215220* Removed Cyber Monday sale advertise
    … …  
    834839
    835840== Upgrade Notice ==
     841= 6.26.18 =
     842* Fixed client IP detection in multi-proxy setups
     843* Fixed error when configuring an invalid UserInfo endpoint
     844* Fixed Debug log unexpected character issue.
     845
    836846= 6.26.17 =
    837847* Removed Cyber Monday sale advertise
Note: See TracChangeset for help on using the changeset viewer.