public function ajax_on()
{
if (!current_user_can('view_query_monitor') or !check_ajax_referer('qm-auth-on', 'nonce', false)) {
wp_send_json_error(__('Could not set authentication cookie.', 'query-monitor'));
}
$expiration = time() + 2 * DAY_IN_SECONDS;
$secure = self::secure_cookie();
$cookie = wp_generate_auth_cookie(get_current_user_id(), $expiration, 'logged_in');
setcookie(QM_COOKIE, $cookie, $expiration, COOKIEPATH, COOKIE_DOMAIN, $secure, false);
$text = __('Authentication cookie set. You can now view Query Monitor output while logged out or while logged in as a different user.', 'query-monitor');
wp_send_json_success($text);
}
开发者ID:L0k1slnk，项目名称:weddly，代码行数:12，代码来源:Html.php
示例6: generate_auth_cookie
public function generate_auth_cookie()
{
global $json_api;
$nonce_id = $json_api->get_nonce_id('auth', 'generate_auth_cookie');
if (!wp_verify_nonce($json_api->query->nonce, $nonce_id)) {
$json_api->error("Your 'nonce' value was incorrect. Use the 'get_nonce' API method.");
}
if (!$json_api->query->username) {
$json_api->error("You must include a 'username' var in your request.");
}
if (!$json_api->query->password) {
$json_api->error("You must include a 'password' var in your request.");
}
$user = wp_authenticate($json_api->query->username, $json_api->query->password);
if (is_wp_error($user)) {
$json_api->error("Invalid username and/or password.", 'error', '401');
remove_action('wp_login_failed', $json_api->query->username);
}
$expiration = time() + apply_filters('auth_cookie_expiration', 1209600, $user->ID, true);
$cookie = wp_generate_auth_cookie($user->ID, $expiration, 'logged_in');
return array("cookie" => $cookie, "user" => array("id" => $user->ID, "username" => $user->user_login, "nicename" => $user->user_nicename, "email" => $user->user_email, "url" => $user->user_url, "registered" => $user->user_registered, "displayname" => $user->display_name, "firstname" => $user->user_firstname, "lastname" => $user->last_name, "nickname" => $user->nickname, "description" => $user->user_description, "capabilities" => $user->wp_capabilities));
}
function testOldUserCookieAuthentication()
{
$admin = $this->testers['admin'];
$editor = $this->testers['editor'];
$expiry = time() + 172800;
// A valid authentication cookie should pass authentication:
$auth_cookie = wp_generate_auth_cookie($editor->ID, $expiry, 'auth');
$_COOKIE[USER_SWITCHING_COOKIE] = json_encode(array($auth_cookie));
$this->assertTrue(user_switching::authenticate_old_user($editor));
$this->assertFalse(user_switching::authenticate_old_user($admin));
// An expired but otherwise valid authentication cookie should not pass authentication:
$auth_cookie = wp_generate_auth_cookie($editor->ID, time() - 1000, 'auth');
$_COOKIE[USER_SWITCHING_COOKIE] = json_encode(array($auth_cookie));
$this->assertFalse(user_switching::authenticate_old_user($editor));
$this->assertFalse(user_switching::authenticate_old_user($admin));
// A valid authentication cookie with the incorrect scheme should not pass authentication:
$logged_in_cookie = wp_generate_auth_cookie($editor->ID, $expiry, 'logged_in');
$_COOKIE[USER_SWITCHING_COOKIE] = json_encode(array($logged_in_cookie));
$this->assertFalse(user_switching::authenticate_old_user($editor));
$this->assertFalse(user_switching::authenticate_old_user($admin));
$logged_in_cookie = wp_generate_auth_cookie($editor->ID, $expiry, 'secure_auth');
$_COOKIE[USER_SWITCHING_COOKIE] = json_encode(array($logged_in_cookie));
$this->assertFalse(user_switching::authenticate_old_user($editor));
$this->assertFalse(user_switching::authenticate_old_user($admin));
// A malformed cookie should not pass authentication and not trigger any PHP errors:
$_COOKIE[USER_SWITCHING_COOKIE] = 'hello';
$this->assertFalse(user_switching::authenticate_old_user($editor));
$this->assertFalse(user_switching::authenticate_old_user($admin));
// A non-JSON-encoded cookie should not pass authentication and not trigger any PHP errors:
$auth_cookie = wp_generate_auth_cookie($editor->ID, $expiry, 'auth');
$_COOKIE[USER_SWITCHING_COOKIE] = $auth_cookie;
$this->assertFalse(user_switching::authenticate_old_user($editor));
$this->assertFalse(user_switching::authenticate_old_user($admin));
// No cookie should not pass authentication and not trigger any PHP errors:
unset($_COOKIE[USER_SWITCHING_COOKIE]);
$this->assertFalse(user_switching::authenticate_old_user($editor));
$this->assertFalse(user_switching::authenticate_old_user($admin));
}
/**
* Sets the authentication cookies based User ID.
*
* The $remember parameter increases the time that the cookie will be kept. The
* default the cookie is kept without remembering is two days. When $remember is
* set, the cookies will be kept for 14 days or two weeks.
*
* @since 2.5
*
* @param int $user_id User ID
* @param bool $remember Whether to remember the user
*/
function wp_set_auth_cookie($user_id, $remember = false, $secure = '') {
if ( $remember ) {
$expiration = time() + apply_filters('auth_cookie_expiration', 14 * DAY_IN_SECONDS, $user_id, $remember);
// Ensure the browser will continue to send the cookie after the expiration time is reached.
// Needed for the login grace period in wp_validate_auth_cookie().
$expire = $expiration + ( 12 * HOUR_IN_SECONDS );
} else {
$expiration = time() + apply_filters('auth_cookie_expiration', 2 * DAY_IN_SECONDS, $user_id, $remember);
$expire = 0;
}
if ( '' === $secure )
$secure = is_ssl();
$secure = apply_filters('secure_auth_cookie', $secure, $user_id);
$secure_logged_in_cookie = apply_filters('secure_logged_in_cookie', false, $user_id, $secure);
if ( $secure ) {
$auth_cookie_name = SECURE_AUTH_COOKIE;
$scheme = 'secure_auth';
} else {
$auth_cookie_name = AUTH_COOKIE;
$scheme = 'auth';
}
$auth_cookie = wp_generate_auth_cookie($user_id, $expiration, $scheme);
$logged_in_cookie = wp_generate_auth_cookie($user_id, $expiration, 'logged_in');
do_action('set_auth_cookie', $auth_cookie, $expire, $expiration, $user_id, $scheme);
do_action('set_logged_in_cookie', $logged_in_cookie, $expire, $expiration, $user_id, 'logged_in');
setcookie($auth_cookie_name, $auth_cookie, $expire, PLUGINS_COOKIE_PATH, COOKIE_DOMAIN, $secure, true);
setcookie($auth_cookie_name, $auth_cookie, $expire, ADMIN_COOKIE_PATH, COOKIE_DOMAIN, $secure, true);
setcookie(LOGGED_IN_COOKIE, $logged_in_cookie, $expire, COOKIEPATH, COOKIE_DOMAIN, $secure_logged_in_cookie, true);
if ( COOKIEPATH != SITECOOKIEPATH )
setcookie(LOGGED_IN_COOKIE, $logged_in_cookie, $expire, SITECOOKIEPATH, COOKIE_DOMAIN, $secure_logged_in_cookie, true);
}
/**
* Set the $_COOKIE values for our custom authentication
*
* Certain areas of WordPress use the $_COOKIE value directly rather than
* passing through the authentication filter, so we need to work
* around this.
*
* @param int $user_id
*/
protected static function set_fake_cookies($user_id)
{
$expiration = time() + apply_filters('auth_cookie_expiration', self::COOKIE_AGE * DAY_IN_SECONDS, $user_id, false);
$expire = 0;
$secure = apply_filters('secure_auth_cookie', is_ssl(), $user_id);
$secure_logged_in_cookie = apply_filters('secure_logged_in_cookie', false, $user_id, $secure);
if ($secure) {
$auth_cookie_name = SECURE_AUTH_COOKIE;
$scheme = 'secure_auth';
} else {
$auth_cookie_name = AUTH_COOKIE;
$scheme = 'auth';
}
$auth_cookie = wp_generate_auth_cookie($user_id, $expiration, $scheme);
$logged_in_cookie = wp_generate_auth_cookie($user_id, $expiration, 'logged_in');
if (!isset($_COOKIE[$auth_cookie_name])) {
$_COOKIE[$auth_cookie_name] = $auth_cookie;
}
if (!isset($_COOKIE[LOGGED_IN_COOKIE])) {
$_COOKIE[LOGGED_IN_COOKIE] = $logged_in_cookie;
}
}
/**
* Get auth cookies and start a session for a user
*
* This is not the security vulerability you think it is:
* 1. anybody with access to WP:CLI can execute commands on behalf of a user without knowing the password
* 2. the session is destroyed when done, so the cookie becomes invalid and useless if intercepted
*/
private function get_auth_cookies($user_id)
{
$expiration = time() + DAY_IN_SECONDS;
require_once ABSPATH . WPINC . '/session.php';
$manager = WP_Session_Tokens::get_instance($user_id);
$this->token = $manager->create($expiration);
return array(SECURE_AUTH_COOKIE => wp_generate_auth_cookie($user_id, $expiration, 'secure_auth', $this->token), AUTH_COOKIE => wp_generate_auth_cookie($user_id, $expiration, 'auth', $this->token), LOGGED_IN_COOKIE => wp_generate_auth_cookie($user_id, $expiration, 'logged_in', $this->token));
}
/**
* Sets the authentication cookies based on user ID.
*
* The $remember parameter increases the time that the cookie will be kept. The
* default the cookie is kept without remembering is two days. When $remember is
* set, the cookies will be kept for 14 days or two weeks.
*
* @since 2.5.0
*
* @param int $user_id User ID
* @param bool $remember Whether to remember the user
* @param mixed $secure Whether the admin cookies should only be sent over HTTPS.
* Default is_ssl().
*/
function wp_set_auth_cookie($user_id, $remember = false, $secure = '')
{
if ($remember) {
/**
* Filter the duration of the authentication cookie expiration period.
*
* @since 2.8.0
*
* @param int $length Duration of the expiration period in seconds.
* @param int $user_id User ID.
* @param bool $remember Whether to remember the user login. Default false.
*/
$expiration = time() + apply_filters('auth_cookie_expiration', 14 * DAY_IN_SECONDS, $user_id, $remember);
/*
* Ensure the browser will continue to send the cookie after the expiration time is reached.
* Needed for the login grace period in wp_validate_auth_cookie().
*/
$expire = $expiration + 12 * HOUR_IN_SECONDS;
} else {
/** This filter is documented in wp-includes/pluggable.php */
$expiration = time() + apply_filters('auth_cookie_expiration', 2 * DAY_IN_SECONDS, $user_id, $remember);
$expire = 0;
}
if ('' === $secure) {
$secure = is_ssl();
}
// Frontend cookie is secure when the auth cookie is secure and the site's home URL is forced HTTPS.
$secure_logged_in_cookie = $secure && 'https' === parse_url(get_option('home'), PHP_URL_SCHEME);
/**
* Filter whether the connection is secure.
*
* @since 3.1.0
*
* @param bool $secure Whether the connection is secure.
* @param int $user_id User ID.
*/
$secure = apply_filters('secure_auth_cookie', $secure, $user_id);
/**
* Filter whether to use a secure cookie when logged-in.
*
* @since 3.1.0
*
* @param bool $secure_logged_in_cookie Whether to use a secure cookie when logged-in.
* @param int $user_id User ID.
* @param bool $secure Whether the connection is secure.
*/
$secure_logged_in_cookie = apply_filters('secure_logged_in_cookie', $secure_logged_in_cookie, $user_id, $secure);
if ($secure) {
$auth_cookie_name = SECURE_AUTH_COOKIE;
$scheme = 'secure_auth';
} else {
$auth_cookie_name = AUTH_COOKIE;
$scheme = 'auth';
}
$manager = WP_Session_Tokens::get_instance($user_id);
$token = $manager->create($expiration);
$auth_cookie = wp_generate_auth_cookie($user_id, $expiration, $scheme, $token);
$logged_in_cookie = wp_generate_auth_cookie($user_id, $expiration, 'logged_in', $token);
/**
* Fires immediately before the authentication cookie is set.
*
* @since 2.5.0
*
* @param string $auth_cookie Authentication cookie.
* @param int $expire Login grace period in seconds. Default 43,200 seconds, or 12 hours.
* @param int $expiration Duration in seconds the authentication cookie should be valid.
* Default 1,209,600 seconds, or 14 days.
* @param int $user_id User ID.
* @param string $scheme Authentication scheme. Values include 'auth', 'secure_auth', or 'logged_in'.
*/
do_action('set_auth_cookie', $auth_cookie, $expire, $expiration, $user_id, $scheme);
/**
* Fires immediately before the secure authentication cookie is set.
*
* @since 2.6.0
*
* @param string $logged_in_cookie The logged-in cookie.
* @param int $expire Login grace period in seconds. Default 43,200 seconds, or 12 hours.
* @param int $expiration Duration in seconds the authentication cookie should be valid.
* Default 1,209,600 seconds, or 14 days.
* @param int $user_id User ID.
* @param string $scheme Authentication scheme. Default 'logged_in'.
*/
do_action('set_logged_in_cookie', $logged_in_cookie, $expire, $expiration, $user_id, 'logged_in');
setcookie($auth_cookie_name, $auth_cookie, $expire, PLUGINS_COOKIE_PATH, COOKIE_DOMAIN, $secure, true);
setcookie($auth_cookie_name, $auth_cookie, $expire, ADMIN_COOKIE_PATH, COOKIE_DOMAIN, $secure, true);
//.........这里部分代码省略.........
/**
* Sets the authentication cookies based User ID.
*
* The $remember parameter increases the time that the cookie will be kept. The
* default the cookie is kept without remembering is two days. When $remember is
* set, the cookies will be kept for 14 days or two weeks.
*
* @since 2.5
*
* @param int $user_id User ID
* @param bool $remember Whether to remember the user or not
*/
function wp_set_auth_cookie($user_id, $remember = false, $secure = '')
{
if ($remember) {
$expiration = $expire = time() + 1209600;
} else {
$expiration = time() + 172800;
$expire = 0;
}
if ('' === $secure) {
$secure = is_ssl() ? true : false;
}
if ($secure) {
$auth_cookie_name = SECURE_AUTH_COOKIE;
$scheme = 'secure_auth';
} else {
$auth_cookie_name = AUTH_COOKIE;
$scheme = 'auth';
}
$auth_cookie = wp_generate_auth_cookie($user_id, $expiration, $scheme);
$logged_in_cookie = wp_generate_auth_cookie($user_id, $expiration, 'logged_in');
do_action('set_auth_cookie', $auth_cookie, $expire, $expiration, $user_id, $scheme);
do_action('set_logged_in_cookie', $logged_in_cookie, $expire, $expiration, $user_id, 'logged_in');
setcookie($auth_cookie_name, $auth_cookie, $expire, PLUGINS_COOKIE_PATH, COOKIE_DOMAIN, $secure);
setcookie($auth_cookie_name, $auth_cookie, $expire, ADMIN_COOKIE_PATH, COOKIE_DOMAIN, $secure);
setcookie(LOGGED_IN_COOKIE, $logged_in_cookie, $expire, COOKIEPATH, COOKIE_DOMAIN);
if (COOKIEPATH != SITECOOKIEPATH) {
setcookie(LOGGED_IN_COOKIE, $logged_in_cookie, $expire, SITECOOKIEPATH, COOKIE_DOMAIN);
}
}
/**
* wp_set_auth_cookie() - Sets the authentication cookies based User ID
*
* The $remember parameter increases the time that the cookie will
* be kept. The default the cookie is kept without remembering is
* two days. When $remember is set, the cookies will be kept for
* 14 days or two weeks.
*
* @since 2.5
*
* @param int $user_id User ID
* @param bool $remember Whether to remember the user or not
*/
function wp_set_auth_cookie($user_id, $remember = false) {
if ( $remember ) {
$expiration = $expire = time() + 1209600;
} else {
$expiration = time() + 172800;
$expire = 0;
}
$cookie = wp_generate_auth_cookie($user_id, $expiration);
do_action('set_auth_cookie', $cookie, $expire);
setcookie(AUTH_COOKIE, $cookie, $expire, COOKIEPATH, COOKIE_DOMAIN);
if ( COOKIEPATH != SITECOOKIEPATH )
setcookie(AUTH_COOKIE, $cookie, $expire, SITECOOKIEPATH, COOKIE_DOMAIN);
}
客服电话
APP下载
官方微信
请发表评论