Permalink
Browse files

First cut and better admin SSL support. see #7001

git-svn-id: http://svn.automattic.com/wordpress/trunk@7998 1a063a9b-81f0-0310-95a4-ce76da25c4cd
  • Loading branch information...
1 parent 67c2a2a commit 9771ec51108be23387f5b9347701bdf2f5731e1b ryan committed May 27, 2008
@@ -85,7 +85,7 @@ function add_minwidth($c) {
<a href="http://gears.google.com/" target="_blank" style="font-weight:normal;"><?php _e('More information...'); ?></a></p>
<p><?php _e('After installing and enabling it, most of the WordPress images, scripts and CSS files will be stored on this computer. This will speed up page loading.'); ?></p>
<p><strong><?php _e('Please make sure you are not using a public or shared computer.'); ?></strong></p>
- <div class="submit"><button onclick="window.location = 'http://gears.google.com/?action=install&return=<?php echo get_option('siteurl') . '/wp-admin/'; ?>';" class="button"><?php _e('Install Now'); ?></button>
+ <div class="submit"><button onclick="window.location = 'http://gears.google.com/?action=install&return=<?php echo admin_url() ?>';" class="button"><?php _e('Install Now'); ?></button>
<button class="button" style="margin-left:10px;" onclick="document.getElementById('gears-info-box').style.display='none';">Cancel</button></div>
</div>
@@ -109,7 +109,7 @@ function add_minwidth($c) {
<?php } ?>
-<div id="user_info"><p><?php printf(__('Howdy, <a href="%1$s">%2$s</a>!'), 'profile.php', $user_identity) ?> | <a href="<?php echo get_option('siteurl'); ?>/wp-login.php?action=logout" title="<?php _e('Log Out') ?>"><?php _e('Log Out'); ?></a> | <?php _e('<a href="http://codex.wordpress.org/">Help</a>') ?> | <?php _e('<a href="http://wordpress.org/support/">Forums</a>') ?> | <?php if ( $gears_compat ) { ?><span id="gears-menu"><a href="#" onclick="wpGears.message(1);return false;"><?php _e('Speed up!') ?></a></span><?php } ?></p></div>
+<div id="user_info"><p><?php printf(__('Howdy, <a href="%1$s">%2$s</a>!'), 'profile.php', $user_identity) ?> | <a href="<?php echo site_url('wp-login.php?action=logout') ?>" title="<?php _e('Log Out') ?>"><?php _e('Log Out'); ?></a> | <?php _e('<a href="http://codex.wordpress.org/">Help</a>') ?> | <?php _e('<a href="http://wordpress.org/support/">Forums</a>') ?> | <?php if ( $gears_compat ) { ?><span id="gears-menu"><a href="#" onclick="wpGears.message(1);return false;"><?php _e('Speed up!') ?></a></span><?php } ?></p></div>
<?php
require(ABSPATH . 'wp-admin/menu-header.php');
View
@@ -26,8 +26,8 @@
wp_reset_vars(array('profile', 'redirect', 'redirect_url', 'a', 'popuptitle', 'popupurl', 'text', 'trackback', 'pingback'));
-wp_admin_css_color('classic', __('Classic'), get_option( 'siteurl' ) . "/wp-admin/css/colors-classic.css", array('#07273E', '#14568A', '#D54E21', '#2683AE'));
-wp_admin_css_color('fresh', __('Fresh'), get_option( 'siteurl' ) . "/wp-admin/css/colors-fresh.css", array('#464646', '#CEE1EF', '#D54E21', '#2683AE'));
+wp_admin_css_color('classic', __('Classic'), admin_url("css/colors-classic.css"), array('#07273E', '#14568A', '#D54E21', '#2683AE'));
+wp_admin_css_color('fresh', __('Fresh'), admin_url("css/colors-fresh.css"), array('#464646', '#CEE1EF', '#D54E21', '#2683AE'));
wp_enqueue_script( 'common' );
wp_enqueue_script( 'jquery-color' );
View
@@ -78,7 +78,7 @@ function comment_footer_die( $msg ) { // $msg is assumed to contain HTML and be
<table width="100%">
<tr>
-<td><input type='button' class="button" value='<?php _e('No'); ?>' onclick="self.location='<?php echo get_option('siteurl'); ?>/wp-admin/edit-comments.php';" /></td>
+<td><input type='button' class="button" value='<?php _e('No'); ?>' onclick="self.location='<?php echo admin_url('edit-comments.php'); ?>" /></td>
<td class="textright"><input type='submit' class="button" value='<?php echo $button; ?>' /></td>
</tr>
</table>
@@ -146,7 +146,7 @@ function comment_footer_die( $msg ) { // $msg is assumed to contain HTML and be
else if ( '' != wp_get_original_referer() && false == $noredir )
wp_redirect( wp_get_original_referer() );
else
- wp_redirect( get_option('siteurl') . '/wp-admin/edit-comments.php' );
+ wp_redirect( admin_url('edit-comments.php') );
die;
break;
@@ -171,7 +171,7 @@ function comment_footer_die( $msg ) { // $msg is assumed to contain HTML and be
if ( '' != wp_get_referer() && false == $noredir )
wp_redirect( wp_get_referer() );
else
- wp_redirect( get_option('siteurl') . '/wp-admin/edit.php?p=' . absint( $comment->comment_post_ID ) . '#comments' );
+ wp_redirect( admin_url('edit.php?p=' . absint( $comment->comment_post_ID ) . '#comments') );
exit();
break;
@@ -200,7 +200,7 @@ function comment_footer_die( $msg ) { // $msg is assumed to contain HTML and be
if ( '' != wp_get_referer() && false == $noredir )
wp_redirect( wp_get_referer() );
else
- wp_redirect( get_option('siteurl') . '/wp-admin/edit.php?p=' . absint( $comment->comment_post_ID ) . '#comments' );
+ wp_redirect( admin_url('edit.php?p=' . absint( $comment->comment_post_ID ) . '#comments') );
exit();
break;
@@ -189,7 +189,7 @@ function step_1() {
<div id="desc"><?php bloginfo('description');?></div>
</div>
<?php if ( !defined( 'NO_HEADER_TEXT' ) ) { ?>
-<form method="post" action="<?php echo get_option('siteurl') ?>/wp-admin/themes.php?page=custom-header&amp;updated=true">
+<form method="post" action="<?php echo admin_url('themes.php?page=custom-header&amp;updated=true') ?>">
<input type="button" value="<?php _e('Hide Text'); ?>" onclick="hide_text()" id="hidetext" />
<input type="button" value="<?php _e('Select a Text Color'); ?>" onclick="colorSelect($('textcolor'), 'pickcolor')" id="pickcolor" /><input type="button" value="<?php _e('Use Original Color'); ?>" onclick="colorDefault()" id="defaultcolor" />
<?php wp_nonce_field('custom-header') ?>
View
@@ -20,8 +20,8 @@
}
$sendback = wp_get_referer();
- if (strpos($sendback, 'page.php') !== false) $sendback = get_option('siteurl') .'/wp-admin/page-new.php';
- elseif (strpos($sendback, 'attachments.php') !== false) $sendback = get_option('siteurl') .'/wp-admin/attachments.php';
+ if (strpos($sendback, 'page.php') !== false) $sendback = admin_url('page-new.php');
+ elseif (strpos($sendback, 'attachments.php') !== false) $sendback = admin_url('attachments.php');
$sendback = preg_replace('|[^a-z0-9-~+_.?#=&;,/:]|i', '', $sendback);
wp_redirect($sendback);
View
@@ -20,8 +20,8 @@
}
$sendback = wp_get_referer();
- if (strpos($sendback, 'post.php') !== false) $sendback = get_option('siteurl') .'/wp-admin/post-new.php';
- elseif (strpos($sendback, 'attachments.php') !== false) $sendback = get_option('siteurl') .'/wp-admin/attachments.php';
+ if (strpos($sendback, 'post.php') !== false) $sendback = admin_url('post-new.php');
+ elseif (strpos($sendback, 'attachments.php') !== false) $sendback = admin_url('attachments.php');
$sendback = preg_replace('|[^a-z0-9-~+_.?#=&;,/:]|i', '', $sendback);
wp_redirect($sendback);
@@ -225,7 +225,7 @@ function wp_dashboard_dynamic_sidebar_params( $params ) {
}
if ( $widget_feed_link )
- $links[] = '<img class="rss-icon" src="' . get_option( 'siteurl' ) . '/' . WPINC . '/images/rss.png" alt="' . __( 'rss icon' ) . '" /> <a href="' . clean_url( $widget_feed_link ) . '">' . __( 'RSS' ) . '</a>';
+ $links[] = '<img class="rss-icon" src="' . includes_url('images/rss.png') . '" alt="' . __( 'rss icon' ) . '" /> <a href="' . clean_url( $widget_feed_link ) . '">' . __( 'RSS' ) . '</a>';
$links = apply_filters( "wp_dashboard_widget_links_$widget_id", $links );
@@ -753,7 +753,7 @@ function media_upload_header() {
function media_upload_form( $errors = null ) {
global $type, $tab;
- $flash_action_url = get_option('siteurl') . "/wp-admin/async-upload.php";
+ $flash_action_url = admin_url('async-upload.php');
// If Mac and mod_security, no Flash. :(
$flash = true;
@@ -784,7 +784,7 @@ function media_upload_form( $errors = null ) {
jQuery(function($){
swfu = new SWFUpload({
upload_url : "<?php echo attribute_escape( $flash_action_url ); ?>",
- flash_url : "<?php echo get_option('siteurl').'/wp-includes/js/swfupload/swfupload_f9.swf'; ?>",
+ flash_url : "<?php echo includes_url('js/swfupload/swfupload_f9.swf'); ?>",
file_post_name: "async-upload",
file_types: "<?php echo apply_filters('upload_file_glob', '*.*'); ?>",
post_params : {
@@ -844,7 +844,7 @@ function media_upload_type_form($type = 'file', $errors = null, $id = null) {
$post_id = intval($_REQUEST['post_id']);
- $form_action_url = get_option('siteurl') . "/wp-admin/media-upload.php?type=$type&tab=type&post_id=$post_id";
+ $form_action_url = admin_url("media-upload.php?type=$type&tab=type&post_id=$post_id");
$form_action_url = apply_filters('media_upload_form_url', $form_action_url, $type);
$callback = "type_form_$type";
@@ -895,7 +895,7 @@ function media_upload_gallery_form($errors) {
$post_id = intval($_REQUEST['post_id']);
- $form_action_url = get_option('siteurl') . "/wp-admin/media-upload.php?type={$GLOBALS['type']}&tab=gallery&post_id=$post_id";
+ $form_action_url = admin_url("media-upload.php?type={$GLOBALS['type']}&tab=gallery&post_id=$post_id");
?>
@@ -934,7 +934,7 @@ function media_upload_library_form($errors) {
$post_id = intval($_REQUEST['post_id']);
- $form_action_url = get_option('siteurl') . "/wp-admin/media-upload.php?type={$GLOBALS['type']}&tab=library&post_id=$post_id";
+ $form_action_url = admin_url("media-upload.php?type={$GLOBALS['type']}&tab=library&post_id=$post_id");
$_GET['paged'] = intval($_GET['paged']);
if ( $_GET['paged'] < 1 )
View
@@ -148,8 +148,8 @@ function redirect_page($page_ID) {
}
$sendback = wp_get_referer();
- if (strpos($sendback, 'page.php') !== false) $sendback = get_option('siteurl') .'/wp-admin/page.php';
- elseif (strpos($sendback, 'attachments.php') !== false) $sendback = get_option('siteurl') .'/wp-admin/attachments.php';
+ if (strpos($sendback, 'page.php') !== false) $sendback = admin_url('page.php');
+ elseif (strpos($sendback, 'attachments.php') !== false) $sendback = admin_url('attachments.php');
$sendback = preg_replace('|[^a-z0-9-~+_.?#=&;,/:]|i', '', $sendback);
wp_redirect($sendback);
exit();
View
@@ -159,8 +159,8 @@ function redirect_post($post_ID = '') {
}
$sendback = wp_get_referer();
- if (strpos($sendback, 'post.php') !== false) $sendback = get_option('siteurl') .'/wp-admin/post-new.php';
- elseif (strpos($sendback, 'attachments.php') !== false) $sendback = get_option('siteurl') .'/wp-admin/attachments.php';
+ if (strpos($sendback, 'post.php') !== false) $sendback = admin_url('post-new.php');
+ elseif (strpos($sendback, 'attachments.php') !== false) $sendback = admin_url('attachments.php');
$sendback = preg_replace('|[^a-z0-9-~+_.?#=&;,/:]|i', '', $sendback);
wp_redirect($sendback);
exit();
View
@@ -57,7 +57,7 @@
<h2><?php _e('Current Theme'); ?></h2>
<div id="current-theme">
<?php if ( $ct->screenshot ) : ?>
-<img src="<?php echo get_option('siteurl') . '/' . $ct->stylesheet_dir . '/' . $ct->screenshot; ?>" alt="<?php _e('Current theme preview'); ?>" />
+<img src="<?php echo site_url($ct->stylesheet_dir . '/' . $ct->screenshot); ?>" alt="<?php _e('Current theme preview'); ?>" />
<?php endif; ?>
<h3><?php printf(_c('%1$s %2$s by %3$s|1: theme title, 2: theme version, 3: theme author'), $ct->title, $ct->version, $ct->author) ; ?></h3>
<p class="description"><?php echo $ct->description; ?></p>
@@ -126,7 +126,7 @@
?>
<a href="<?php echo $activate_link; ?>" class="<?php echo $thickbox_class; ?> screenshot">
<?php if ( $screenshot ) : ?>
- <img src="<?php echo ( $tpage == 'stage' ) ? $screenshot : get_option('siteurl') . '/' . $stylesheet_dir . '/' . $screenshot; ?>" alt="" />
+ <img src="<?php echo ( $tpage == 'stage' ) ? $screenshot : site_url($stylesheet_dir . '/' . $screenshot); ?>" alt="" />
<?php endif; ?>
</a>
<h3><a class="<?php echo $thickbox_class; ?>" href="<?php echo $activate_link; ?>"><?php echo $title; ?></a></h3>
View
@@ -396,9 +396,9 @@
<?php
if ( get_option('users_can_register') )
- echo '<p>' . sprintf(__('Users can <a href="%1$s">register themselves</a> or you can manually create users here.'), get_option('siteurl').'/wp-register.php') . '</p>';
+ echo '<p>' . sprintf(__('Users can <a href="%1$s">register themselves</a> or you can manually create users here.'), site_url('wp-register.php')) . '</p>';
else
- echo '<p>' . sprintf(__('Users cannot currently <a href="%1$s">register themselves</a>, but you can manually create users here.'), get_option('siteurl').'/wp-admin/options-general.php#users_can_register') . '</p>';
+ echo '<p>' . sprintf(__('Users cannot currently <a href="%1$s">register themselves</a>, but you can manually create users here.'), admin_url('options-general.php#users_can_register')) . '</p>';
?>
<form action="#add-new-user" method="post" name="adduser" id="adduser" class="add:users: validate">
<?php wp_nonce_field('add-user') ?>
@@ -1765,4 +1765,7 @@ function validate_file( $file, $allowed_files = '' ) {
return 0;
}
+function is_ssl() {
+ return ( 'on' == strtolower($_SERVER['HTTPS']) ) ? true : false;
+}
?>
@@ -1139,7 +1139,7 @@ function wp_admin_css_uri( $file = 'wp-admin' ) {
if ( defined('WP_INSTALLING') ) {
$_file = "./$file.css";
} else {
- $_file = get_option( 'siteurl' ) . "/wp-admin/$file.css";
+ $_file = admin_url("$file.css");
}
$_file = add_query_arg( 'version', get_bloginfo( 'version' ), $_file );
@@ -774,4 +774,42 @@ function a(){
return apply_filters('shortcut_link', $link);
}
+
+// return the site_url option, using https if is_ssl() is true
+// if $scheme is 'http' or 'https' it will override is_ssl()
+function site_url($path = '', $scheme = null) {
+ // should the list of allowed schemes be maintained elsewhere?
+ if ( !in_array($scheme, array('http', 'https')) )
+ $scheme = ( is_ssl() ? 'https' : 'http' );
+
+ $url = str_replace( 'http://', "{$scheme}://", get_option('siteurl') );
+
+ if ( !empty($path) && is_string($path) && strpos($path, '..') === false )
+ $url .= '/' . ltrim($path, '/');
+
+ return $url;
+}
+
+function admin_url($path = '') {
+ global $_wp_admin_url;
+
+ $url = site_url() . '/wp-admin/';
+
+ if ( !empty($path) && is_string($path) && strpos($path, '..') === false )
+ $url .= ltrim($path, '/');
+
+ return $url;
+}
+
+function includes_url($path = '') {
+ global $_wp_includes_url;
+
+ $url = site_url() . '/' . WPINC . '/';
+
+ if ( !empty($path) && is_string($path) && strpos($path, '..') === false )
+ $url .= ltrim($path, '/');
+
+ return $url;
+}
+
?>
View
@@ -306,7 +306,7 @@ function wp_get_attachment_image_src($attachment_id, $size='thumbnail', $icon =
return $image;
if ( $icon && $src = wp_mime_type_icon($attachment_id) ) {
- $icon_dir = apply_filters( 'icon_dir', ABSPATH . WPINC . '/images/crystal' );
+ $icon_dir = apply_filters( 'icon_dir', includes_url('images/crystal') );
$src_file = $icon_dir . '/' . basename($src);
@list($width, $height) = getimagesize($src_file);
}
View
@@ -469,9 +469,14 @@ function wp_logout() {
*/
function wp_validate_auth_cookie($cookie = '') {
if ( empty($cookie) ) {
- if ( empty($_COOKIE[AUTH_COOKIE]) )
+ if ( is_ssl() )
+ $cookie_name = SECURE_AUTH_COOKIE;
+ else
+ $cookie_name = AUTH_COOKIE;
+
+ if ( empty($_COOKIE[$cookie_name]) )
return false;
- $cookie = $_COOKIE[AUTH_COOKIE];
+ $cookie = $_COOKIE[$cookie_name];
}
$cookie_elements = explode('|', $cookie);
@@ -514,17 +519,18 @@ function wp_validate_auth_cookie($cookie = '') {
*
* @param int $user_id User ID
* @param int $expiration Cookie expiration in seconds
+ * @param bool $secure Whether the cookie is for https delivery only or not. Not used by default. For plugin use.
* @return string Authentication cookie contents
*/
-function wp_generate_auth_cookie($user_id, $expiration) {
+function wp_generate_auth_cookie($user_id, $expiration, $secure = false) {
$user = get_userdata($user_id);
$key = wp_hash($user->user_login . '|' . $expiration);
$hash = hash_hmac('md5', $user->user_login . '|' . $expiration, $key);
$cookie = $user->user_login . '|' . $expiration . '|' . $hash;
- return apply_filters('auth_cookie', $cookie, $user_id, $expiration);
+ return apply_filters('auth_cookie', $cookie, $user_id, $expiration, $secure);
}
endif;
@@ -550,13 +556,21 @@ function wp_set_auth_cookie($user_id, $remember = false) {
$expire = 0;
}
- $cookie = wp_generate_auth_cookie($user_id, $expiration);
+ if ( is_ssl() ) {
+ $secure = true;
+ $cookie_name = SECURE_AUTH_COOKIE;
+ } else {
+ $secure = false;
+ $cookie_name = AUTH_COOKIE;
+ }
+
+ $cookie = wp_generate_auth_cookie($user_id, $expiration, $secure);
- do_action('set_auth_cookie', $cookie, $expire);
+ do_action('set_auth_cookie', $cookie, $expire, $secure);
- setcookie(AUTH_COOKIE, $cookie, $expire, COOKIEPATH, COOKIE_DOMAIN);
+ setcookie($cookie_name, $cookie, $expire, COOKIEPATH, COOKIE_DOMAIN, $secure);
if ( COOKIEPATH != SITECOOKIEPATH )
- setcookie(AUTH_COOKIE, $cookie, $expire, SITECOOKIEPATH, COOKIE_DOMAIN);
+ setcookie($cookie_name, $cookie, $expire, SITECOOKIEPATH, COOKIE_DOMAIN, $secure);
}
endif;
@@ -569,6 +583,8 @@ function wp_set_auth_cookie($user_id, $remember = false) {
function wp_clear_auth_cookie() {
setcookie(AUTH_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
setcookie(AUTH_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);
+ setcookie(SECURE_AUTH_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
+ setcookie(SECURE_AUTH_COOKIE, ' ', time() - 31536000, SITECOOKIEPATH, COOKIE_DOMAIN);
// Old cookies
setcookie(USER_COOKIE, ' ', time() - 31536000, COOKIEPATH, COOKIE_DOMAIN);
@@ -604,14 +620,36 @@ function is_user_logged_in() {
*/
function auth_redirect() {
// Checks if a user is logged in, if not redirects them to the login page
- if ( (!empty($_COOKIE[AUTH_COOKIE]) &&
- !wp_validate_auth_cookie($_COOKIE[AUTH_COOKIE])) ||
- (empty($_COOKIE[AUTH_COOKIE])) ) {
- nocache_headers();
- wp_redirect(get_option('siteurl') . '/wp-login.php?redirect_to=' . urlencode($_SERVER['REQUEST_URI']));
- exit();
+ if ( is_ssl() || (defined('FORCE_SSL_LOGIN') && FORCE_SSL_LOGIN) )
+ $secure = true;
+ else
+ $secure = false;
+
+ // If https is required and request is http, redirect
+ if ( $secure && !is_ssl() ) {
+ if ( false !== strpos($_SERVER['REQUEST_URI'], 'http') ) {
+ wp_redirect(str_replace('http://', 'https://', $_SERVER['REQUEST_URI']));
+ exit();
+ } else {
+ wp_redirect('https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
+ exit();
+ }
}
+
+ if ( wp_validate_auth_cookie() )
+ return; // The cookie is good so we're done
+
+ // The cookie is no good so force login
+ nocache_headers();
+
+ $login_url = get_option('siteurl') . '/wp-login.php?redirect_to=' . urlencode($_SERVER['REQUEST_URI']);
+
+ // Redirect to https if connection is secure
+ if ( $secure )
+ $login_url = str_replace('http://', 'https://', $login_url);
+ wp_redirect($login_url);
+ exit();
}
endif;
Oops, something went wrong.

0 comments on commit 9771ec5

Please sign in to comment.