2.0.2 Released

Author: techjewel

app/Helpers/Helper.php

@@ -486,7 +486,7 @@ public static function formatAuthCustomizerSettings($settingFields)
 
         $formattedFields = [];
         foreach ($settingFields as $section => $settings) {
-            if(is_string($settings)) {
+            if (is_string($settings)) {
                 $formattedFields[$section] = sanitize_text_field($settings);
                 continue;
             }
@@ -503,4 +503,15 @@ public static function formatAuthCustomizerSettings($settingFields)
 
         return $formattedFields;
     }
+
+    public static function getValidatedRedirectUrl($location, $fallback = '')
+    {
+        $validated = wp_validate_redirect($location, $fallback);
+
+        if($validated !== $location) {
+            return apply_filters('fluent_auth/validated_redirect', $validated, $location, $fallback);
+        }
+
+        return $validated;
+    }
 }

app/Hooks/Handlers/BasicTasksHandler.php

@@ -127,7 +127,7 @@ public function maybeInterceptRestUserQuery($query)
     public function maybeInterceptRestUserResponse($response, $user, $request)
     {
         if (!empty($request['id']) && Helper::getSetting('disable_users_rest') === 'yes' && !current_user_can('edit_others_posts')) {
-            return new \WP_Error('permission_error', 'You do not have access to list users. Restriction added from fluent auth plugin');
+            return new \WP_Error('permission_error', __('You do not have access to list users. Restriction added from fluent auth plugin', 'fluent-security'));
         }
         return $response;
     }

app/Hooks/Handlers/CustomAuthHandler.php

@@ -37,6 +37,18 @@ public function alterLoginRedirectUrl($redirect_to, $intentRedirectTo, $user)
             return $redirect_to;
         }
 
+        // check if we have value from cookie _fls_redirect_to
+        if (isset($_COOKIE['_fls_redirect_to']) && filter_var($_COOKIE['_fls_redirect_to'], FILTER_VALIDATE_URL)) {
+            $redirect_to = sanitize_url($_COOKIE['_fls_redirect_to']);
+            $validatedRedirectUrl = Helper::getValidatedRedirectUrl($redirect_to, admin_url());
+            unset($_COOKIE['_fls_redirect_to']);
+            setcookie('_fls_redirect_to', '', time() - 3600, COOKIEPATH, COOKIE_DOMAIN);
+            if ($validatedRedirectUrl == $redirect_to) {
+                return $redirect_to;
+            }
+
+        }
+
         if (apply_filters('fluent_auth/respect_front_login_url', true) && strpos($redirect_to, '/wp-admin') === false) {
             // it's a frontend redirect url
         } else if ($url = $this->getDefaultLoginRedirectUrl($user)) {
@@ -74,6 +86,11 @@ public function loginForm($attributes, $headerContent = '')
             $message = apply_filters('fluent_auth/already_logged_in_message',
                 sprintf(__('You are already logged in. <a href="%s">Go to Home Page</a>', 'fluent-security'), site_url())
             );
+
+            if (!$message) {
+                return '';
+            }
+
             return '<p>' . $message . '</p>';
         }
 
@@ -88,9 +105,11 @@ public function loginForm($attributes, $headerContent = '')
         }
 
         $redirect = '';
+        $requestedRedirectTo = '';
 
         if (!empty($attributes['redirect_to']) && filter_var($attributes['redirect_to'], FILTER_VALIDATE_URL)) {
             $redirect = $attributes['redirect_to'];
+            $requestedRedirectTo = $redirect;
             add_filter('fluent_auth/social_redirect_to', function ($url) use ($redirect) {
                 return $redirect;
             });
@@ -104,11 +123,12 @@ public function loginForm($attributes, $headerContent = '')
          * @param array $loginArgs
          */
         $loginArgs = apply_filters('fluent_auth/login_form_args', [
-            'echo'           => false,
-            'redirect'       => $redirect,
-            'remember'       => true,
-            'value_remember' => true,
-            'action_url'     => site_url('/')
+            'echo'              => false,
+            'redirect'          => $redirect,
+            'force_redirect_to' => $requestedRedirectTo,
+            'remember'          => true,
+            'value_remember'    => true,
+            'action_url'        => site_url('/')
         ]);
 
         $return .= $this->nativeLoginForm($loginArgs);
@@ -672,6 +692,11 @@ public function handleLoginAjax()
         }
 
         $data = $_REQUEST;
+        if (empty($_REQUEST['_is_fls_form'])) {
+            wp_send_json([
+                'message' => __('Invalid request', 'fluent-security')
+            ], 422);
+        }
 
         if (empty($data['pwd']) || empty($data['log'])) {
             wp_send_json([
@@ -682,13 +707,20 @@ public function handleLoginAjax()
         $redirectUrl = admin_url();
         if (isset($data['redirect_to']) && filter_var($data['redirect_to'], FILTER_VALIDATE_URL)) {
             $userRedirect = sanitize_url($data['redirect_to']);
-            $redirectUrl = wp_validate_redirect($userRedirect, $redirectUrl);
+            $redirectUrl = Helper::getValidatedRedirectUrl($userRedirect, $redirectUrl);
+        }
+
+        $isForced = false;
+        if (!empty($data['force_redirect_to']) && filter_var($data['force_redirect_to'], FILTER_VALIDATE_URL)) {
+            $redirectUrl = Helper::getValidatedRedirectUrl(sanitize_url($data['force_redirect_to']), $redirectUrl);
+            $isForced = true;
         }
 
         if ($currentUserId = get_current_user_id()) { // user already logged in
             $user = get_user_by('ID', $currentUserId);
-            $redirectUrl = apply_filters('login_redirect', $redirectUrl, false, $user);
-
+            if (!$isForced) {
+                $redirectUrl = apply_filters('login_redirect', $redirectUrl, false, $user);
+            }
             wp_send_json([
                 'redirect' => $redirectUrl
             ], 200);
@@ -712,15 +744,21 @@ public function handleLoginAjax()
             ], 422);
         }
 
+
         $user = wp_signon();
+
         if (is_wp_error($user)) {
             wp_send_json([
                 'message' => $user->get_error_message()
             ], 422);
         }
 
-        $filteredRedirectUrl = apply_filters('login_redirect', $redirectUrl, false, $user);
-        $filteredRedirectUrl = apply_filters('fluent_auth/login_redirect_url', $filteredRedirectUrl, $user, $_REQUEST);
+        if (!$isForced) {
+            $filteredRedirectUrl = apply_filters('login_redirect', $redirectUrl, false, $user);
+            $filteredRedirectUrl = apply_filters('fluent_auth/login_redirect_url', $filteredRedirectUrl, $user, $_REQUEST);
+        } else {
+            $filteredRedirectUrl = $redirectUrl;
+        }
 
         wp_send_json([
             'redirect' => $filteredRedirectUrl
@@ -851,7 +889,7 @@ public function handleSignupAjax()
         if ($isAutoLogin) {
             $this->login($userId);
             $redirectUrl = Arr::get($formData, 'redirect_to', admin_url());
-            $redirectUrl = wp_validate_redirect($redirectUrl, admin_url());
+            $redirectUrl = Helper::getValidatedRedirectUrl($redirectUrl, admin_url());
             $redirectUrl = apply_filters('login_redirect', $redirectUrl, false, $user);
             $redirectUrl = apply_filters('fluent_auth/login_redirect_url', $redirectUrl, $user, $formData);
             $message = __('Successfully registered to the site.', 'fluent-security');
@@ -1092,6 +1130,10 @@ protected function nativeLoginForm($args = array())
             $actionUrl = esc_url($args['action_url']);
         }
 
+        if (!empty($args['force_redirect_to'])) {
+            $login_form_top .= '<input type="hidden" name="force_redirect_to" value="' . esc_url($args['force_redirect_to']) . '" />';
+        }
+
         $form = \sprintf(
                 '<form name="%1$s" id="%1$s" action="%2$s" method="post">',
                 esc_attr($args['form_id']),

app/Hooks/Handlers/MagicLoginHandler.php

@@ -19,6 +19,18 @@ public function register()
                 $hash = sanitize_text_field($_GET['fls_al']);
                 $this->makeLogin($hash);
             }
+
+            if (isset($_GET['redirect_to']) && !wp_doing_ajax()) {
+                if (get_current_user_id()) {
+                    return;
+                }
+
+                $redirectTo = esc_url_raw($_REQUEST['redirect_to']);
+                if (filter_var($redirectTo, FILTER_VALIDATE_URL)) {
+                    // set cookie to redirect after login
+                    setcookie('_fls_redirect_to', $redirectTo, time() + 600, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true);
+                }
+            }
         }, 1);
 
         add_filter('login_form_bottom', [$this, 'maybeMagicFormOnLoginFunc']);
@@ -68,9 +80,12 @@ public function maybePushMagicForm()
         ?>
         <div style="display: none;" id="fls_magic_login">
             <div class="fls_magic_initial">
-                <div class="fls_magic-or">
-                    <span><?php _e('Or', 'fluent-security') ?></span>
+                <div class="fls_or_wrap">
+                    <div class="fls_magic-or">
+                        <span><?php _e('Or', 'fluent-security') ?></span>
+                    </div>
                 </div>
+
                 <div class="fls_magic_login_btn">
                     <button class="fls_magic_show_btn magic_btn_secondary button button-primary button-large">
                         <?php _e('Login Via Magic URL', 'fluent-security'); ?>
@@ -84,17 +99,21 @@ public function maybePushMagicForm()
                 <label for="fls_magic_logon">
                     <?php _e('Your Email/Username', 'fluent-security'); ?>
                 </label>
-                <input placeholder="<?php _e('Your Email/Username', 'fluent-security'); ?>" id="fls_magic_logon" class="fls_magic_input" type="text" name="fls_magic_logon_email"/>
-                <input id="fls_magic_logon_nonce" type="hidden" name="fls_magic_logon_nonce" value="<?php echo wp_create_nonce('fls_magic_logon_nonce'); ?>"/>
+                <input placeholder="<?php _e('Your Email/Username', 'fluent-security'); ?>" id="fls_magic_logon"
+                       class="fls_magic_input" type="text" name="fls_magic_logon_email"/>
+                <input id="fls_magic_logon_nonce" type="hidden" name="fls_magic_logon_nonce"
+                       value="<?php echo wp_create_nonce('fls_magic_logon_nonce'); ?>"/>
                 <div class="fls_magic_submit_wrapper">
                     <button class="button button-primary button-large" id="fls_magic_submit">
                         <?php _e('Continue', 'fluent-security'); ?>
                     </button>
                 </div>
 
                 <div class="magic_back_regular">
-                    <div class="fls_magic-or">
-                        <span><?php _e('Or', 'fluent-security'); ?></span>
+                    <div class="fls_or_wrap">
+                        <div class="fls_magic-or">
+                            <span><?php _e('Or', 'fluent-security') ?></span>
+                        </div>
                     </div>
                     <div class="fls_magic_login_back">
                         <button class="fls_magic_show_regular magic_btn_secondary">
@@ -133,7 +152,7 @@ public function pushAssets()
             'success_icon' => FLUENT_AUTH_PLUGIN_URL . 'dist/images/success.png',
             'empty_text'   => __('Please provide username / email to get magic login link', 'fluent-security'),
             'wait_text'    => __('Please Wait...', 'fluent-security'),
-            'is_primary' => Helper::getSetting('magic_link_primary') === 'yes'
+            'is_primary'   => Helper::getSetting('magic_link_primary') === 'yes'
         ]);
 
         $this->assetLoaded = true;
@@ -181,7 +200,7 @@ public function handleMagicLoginAjax()
         // Let's prepare
         if (strpos($username, '@')) {
             $user = get_user_by('email', $username);
-            if(!$user) {
+            if (!$user) {
                 $user = get_user_by('login', $username);
             }
         } else {
@@ -224,7 +243,7 @@ public function handleMagicLoginAjax()
             __('If the button above does not work, paste this link into your web browser:', 'fluent-security'),
             esc_url($loginUrl),
             ' ',
-            __('If you did not make this request, you can safely ignore this email.','fluent-security')
+            __('If you did not make this request, you can safely ignore this email.', 'fluent-security')
         ];
 
         $emailBody = '';
@@ -374,7 +393,7 @@ public function makeLogin($hash)
 
         add_filter('authenticate', array($this, 'allowProgrammaticLogin'), 10, 3);    // hook in earlier than other callbacks to short-circuit them
         $user = wp_signon(array(
-                'user_login' => $user->user_login,
+                'user_login'    => $user->user_login,
                 'user_password' => ''
             )
         );

app/Hooks/Handlers/ServerModeHandler.php

@@ -3,7 +3,6 @@
 namespace FluentAuth\App\Hooks\Handlers;
 
 use FluentAuth\App\Helpers\Arr;
-use function Sodium\add;
 
 class ServerModeHandler
 {
@@ -14,13 +13,35 @@ public function register()
             return;
         }
 
-
         add_filter('fluent_security/app_vars', function ($vars) {
             $vars['has_server_mode'] = 'yes';
             return $vars;
         });
 
+        add_filter('fluent_auth/validated_redirect', function ($validated, $location) {
+            // check if the location is a child site
+            $authSites = get_option('__fls_child_sites', []);
+            if (empty($authSites)) {
+                return $validated;
+            }
+
+            $locationSiteDomain = parse_url($location, PHP_URL_HOST);
 
+            foreach ($authSites as $authSite) {
+                $childSiteUrl = $authSite['site_url'];
+                if (!$childSiteUrl) {
+                    continue;
+                }
+
+                // child site domain
+                $childSiteDomain = parse_url($childSiteUrl, PHP_URL_HOST);
+                if ($locationSiteDomain === $childSiteDomain) {
+                    return $location;
+                }
+            }
+
+            return $validated;
+        }, 99, 2);
 
         add_action('init', [$this, 'maybeRemoteLoginInit'], 1);
 
@@ -68,7 +89,6 @@ public function maybeRemoteLoginRedirect($redirect_to, $intentRedirectTo, $user)
     {
         // check cookie
         if (isset($_COOKIE['__fls_auth_client_id'])) {
-
             $clientId = sanitize_text_field($_COOKIE['__fls_auth_client_id']);
             $authSites = get_option('__fls_child_sites', []);
             if (!isset($authSites[$clientId])) {

app/Hooks/Handlers/SocialAuthHandler.php

@@ -384,7 +384,7 @@ public function pushLoginWithButtons()
             'google'   => [
                 'link_class' => 'fs_auth_btn fs_auth_google',
                 'icon'       => '<svg xmlns="http://www.w3.org/2000/svg"  viewBox="0 0 48 48" width="24px" height="24px"><path fill="#FFC107" d="M43.611,20.083H42V20H24v8h11.303c-1.649,4.657-6.08,8-11.303,8c-6.627,0-12-5.373-12-12c0-6.627,5.373-12,12-12c3.059,0,5.842,1.154,7.961,3.039l5.657-5.657C34.046,6.053,29.268,4,24,4C12.955,4,4,12.955,4,24c0,11.045,8.955,20,20,20c11.045,0,20-8.955,20-20C44,22.659,43.862,21.35,43.611,20.083z"/><path fill="#FF3D00" d="M6.306,14.691l6.571,4.819C14.655,15.108,18.961,12,24,12c3.059,0,5.842,1.154,7.961,3.039l5.657-5.657C34.046,6.053,29.268,4,24,4C16.318,4,9.656,8.337,6.306,14.691z"/><path fill="#4CAF50" d="M24,44c5.166,0,9.86-1.977,13.409-5.192l-6.19-5.238C29.211,35.091,26.715,36,24,36c-5.202,0-9.619-3.317-11.283-7.946l-6.522,5.025C9.505,39.556,16.227,44,24,44z"/><path fill="#1976D2" d="M43.611,20.083H42V20H24v8h11.303c-0.792,2.237-2.231,4.166-4.087,5.571c0.001-0.001,0.002-0.001,0.003-0.002l6.19,5.238C36.971,39.205,44,34,44,24C44,22.659,43.862,21.35,43.611,20.083z"/></svg>',
-                'title'      => 'Login with Google',
+                'title'      => __('Login with Google', 'fluent-security'),
                 'url'        => add_query_arg([
                     'fs_auth'            => 'google',
                     'fs_type'            => 'redirect',
@@ -394,7 +394,7 @@ public function pushLoginWithButtons()
             'github'   => [
                 'link_class' => 'fs_auth_btn fs_auth_github',
                 'icon'       => '<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" role="img" aria-labelledby="ahu5wq2nrtsicu3szbxaract8as7mhww" aria-hidden="true" class="crayons-icon"><title id="ahu5wq2nrtsicu3szbxaract8as7mhww">github</title><path d="M12 2C6.475 2 2 6.475 2 12a9.994 9.994 0 006.838 9.488c.5.087.687-.213.687-.476 0-.237-.013-1.024-.013-1.862-2.512.463-3.162-.612-3.362-1.175-.113-.288-.6-1.175-1.025-1.413-.35-.187-.85-.65-.013-.662.788-.013 1.35.725 1.538 1.025.9 1.512 2.338 1.087 2.912.825.088-.65.35-1.087.638-1.337-2.225-.25-4.55-1.113-4.55-4.938 0-1.088.387-1.987 1.025-2.688-.1-.25-.45-1.275.1-2.65 0 0 .837-.262 2.75 1.026a9.28 9.28 0 012.5-.338c.85 0 1.7.112 2.5.337 1.912-1.3 2.75-1.024 2.75-1.024.55 1.375.2 2.4.1 2.65.637.7 1.025 1.587 1.025 2.687 0 3.838-2.337 4.688-4.562 4.938.362.312.675.912.675 1.85 0 1.337-.013 2.412-.013 2.75 0 .262.188.574.688.474A10.016 10.016 0 0022 12c0-5.525-4.475-10-10-10z"></path></svg>',
-                'title'      => 'Login with Github',
+                'title'      => __('Login with Github', 'fluent-security'),
                 'url'        => add_query_arg([
                     'fs_auth'            => 'github',
                     'fs_type'            => 'redirect',
@@ -404,7 +404,7 @@ public function pushLoginWithButtons()
             'facebook' => [
                 'link_class' => 'fs_auth_btn fs_auth_facebook',
                 'icon'       => '<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="#4267B2"><path d="M22.675 0h-21.35c-.732 0-1.325.593-1.325 1.325v21.351c0 .731.593 1.324 1.325 1.324h11.495v-9.294h-3.128v-3.622h3.128v-2.671c0-3.1 1.893-4.788 4.659-4.788 1.325 0 2.463.099 2.795.143v3.24l-1.918.001c-1.504 0-1.795.715-1.795 1.763v2.313h3.587l-.467 3.622h-3.12v9.293h6.116c.73 0 1.323-.593 1.323-1.325v-21.35c0-.732-.593-1.325-1.325-1.325z"/></svg>',
-                'title'      => 'Login with Facebook',
+                'title'      => __('Login with Facebook', 'fluent-security'),
                 'url'        => add_query_arg([
                     'fs_auth'            => 'facebook',
                     'fs_type'            => 'redirect',

app/Hooks/Handlers/TwoFaHandler.php

@@ -94,7 +94,7 @@ public function sendAndGet2FaConfirmFormUrl($user, $return = 'url')
         $hash .= $user->ID . '-' . time();
 
         $redirectIntend = '';
-        if (isset($_GET['redirect_to'])) {
+        if (isset($_REQUEST['redirect_to'])) {
             $redirectIntend = esc_url($_GET['redirect_to']);
         }