Commit Graph

30 Commits

Author SHA1 Message Date
Sergey Biryukov
4eee0d2fb7 Tests: Use assertSame() in some newly introduced tests.
This ensures that not only the return values match the expected results, but also that their type is the same.

Going forward, stricter type checking by using `assertSame()` should generally be preferred to `assertEquals()` where appropriate, to make the tests more reliable.

Follow-up to [48937], [48939], [48940], [48944].

See #38266.

git-svn-id: https://develop.svn.wordpress.org/trunk@49547 602fd350-edb4-49c9-b593-d223f7449a82
2020-11-09 15:43:14 +00:00
TimothyBlynJacobs
1856d0fe2a REST API: Introduce Application Passwords for API authentication.
In WordPress 4.4 the REST API was first introduced. A few releases later in WordPress 4.7, the Content API endpoints were added, paving the way for Gutenberg and countless in-site experiences. In the intervening years, numerous plugins have built on top of the REST API. Many developers shared a common frustration, the lack of external authentication to the REST API.

This commit introduces Application Passwords to allow users to connect to external applications to their WordPress website. Users can generate individual passwords for each application, allowing for easy revocation and activity monitoring. An authorization flow is introduced to make the connection flow simple for users and application developers.

Application Passwords uses Basic Authentication, and by default is only available over an SSL connection.

Props georgestephanis, kasparsd, timothyblynjacobs, afercia, akkspro, andraganescu, arippberger, aristath, austyfrosty, ayesh, batmoo, bradyvercher, brianhenryie, helen, ipstenu, jeffmatson, jeffpaul, joostdevalk, joshlevinson, kadamwhite, kjbenk, koke, michael-arestad, Otto42, pekz0r, salzano, spacedmonkey, valendesigns.
Fixes #42790.


git-svn-id: https://develop.svn.wordpress.org/trunk@49109 602fd350-edb4-49c9-b593-d223f7449a82
2020-10-08 22:12:02 +00:00
Sergey Biryukov
164b22cf6a Tests: First pass at using assertSame() instead of assertEquals() in most of the unit tests.
This ensures that not only the return values match the expected results, but also that their type is the same.

Going forward, stricter type checking by using `assertSame()` should generally be preferred to `assertEquals()` where appropriate, to make the tests more reliable.

Props johnbillion, jrf, SergeyBiryukov.
See #38266.

git-svn-id: https://develop.svn.wordpress.org/trunk@48937 602fd350-edb4-49c9-b593-d223f7449a82
2020-09-02 00:35:36 +00:00
Sergey Biryukov
cfc3b57488 Docs: Improve inline comments per the documentation standards.
Includes minor code layout fixes for better readability.

See #48303.

git-svn-id: https://develop.svn.wordpress.org/trunk@47122 602fd350-edb4-49c9-b593-d223f7449a82
2020-01-29 00:43:23 +00:00
Sergey Biryukov
20165c2ffb Login and Registration: Simplify the test for wp_signon() added in [46640].
Make sure it actually tests the change in behavior, previously it passed both before and after the patch.

Add `wp_unslash()` to the last remaining instance of `$_POST['user_login']` that didn't have it.

See #38744.

git-svn-id: https://develop.svn.wordpress.org/trunk@46650 602fd350-edb4-49c9-b593-d223f7449a82
2019-11-04 15:04:41 +00:00
Jake Spurlock
778bf0c721 Administration: Ensure that admin referer nonce is valid.
Fix for a testing regression.

Props desrosj.


git-svn-id: https://develop.svn.wordpress.org/trunk@46485 602fd350-edb4-49c9-b593-d223f7449a82
2019-10-14 17:13:35 +00:00
Jake Spurlock
f53a78fda7 Administration: Ensure that admin referer nonce is valid.
Coding standards, ensure that nonce is valid with identical, rather then equal operator.

Props vortfu, xknown, whyisjake.


git-svn-id: https://develop.svn.wordpress.org/trunk@46477 602fd350-edb4-49c9-b593-d223f7449a82
2019-10-14 15:38:14 +00:00
Sergey Biryukov
6c78848612 Users: Clean user cache in check_password_reset_key() tests.
Props davidbaumwald, spacedmonkey.
See #45845.

git-svn-id: https://develop.svn.wordpress.org/trunk@45717 602fd350-edb4-49c9-b593-d223f7449a82
2019-08-01 19:53:45 +00:00
Sergey Biryukov
f912470ac3 Users: Use wp_update_user() in get_password_reset_key().
Props jayswadas, spacedmonkey, donmhico, SergeyBiryukov.
Fixes #45746.

git-svn-id: https://develop.svn.wordpress.org/trunk@45714 602fd350-edb4-49c9-b593-d223f7449a82
2019-08-01 17:24:20 +00:00
Gary Pendergast
a75d153eee Coding Standards: Upgrade WPCS to 1.0.0
WPCS 1.0.0 includes a bunch of new auto-fixers, which drops the number of coding standards issues across WordPress significantly. Prior to running the auto-fixers, there were 15,312 issues detected. With this commit, we now drop to 4,769 issues.

This change includes three notable additions:
- Multiline function calls must now put each parameter on a new line.
- Auto-formatting files is now part of the `grunt precommit` script. 
- Auto-fixable coding standards issues will now cause Travis failures.

Fixes #44600.



git-svn-id: https://develop.svn.wordpress.org/trunk@43571 602fd350-edb4-49c9-b593-d223f7449a82
2018-08-17 01:50:26 +00:00
Gary Pendergast
8f95800d52 Code is Poetry.
WordPress' code just... wasn't.
This is now dealt with.

Props jrf, pento, netweb, GaryJ, jdgrimes, westonruter, Greg Sherwood from PHPCS, and everyone who's ever contributed to WPCS and PHPCS.
Fixes #41057.



git-svn-id: https://develop.svn.wordpress.org/trunk@42343 602fd350-edb4-49c9-b593-d223f7449a82
2017-11-30 23:09:33 +00:00
John Blackbourn
8b1afc4743 Build/Test Tools: Add an extra WP_Error assertion when testing a valid user activation key. This provides a better failure message if the assertion does fail.
See #38716


git-svn-id: https://develop.svn.wordpress.org/trunk@39364 602fd350-edb4-49c9-b593-d223f7449a82
2016-11-27 01:24:58 +00:00
John Blackbourn
a03376e798 Security: Trigger a _doing_it_wrong() when check_ajax_referer() is called without its first parameter. This brings it inline with check_admin_referer().
Fixes #36361


git-svn-id: https://develop.svn.wordpress.org/trunk@38420 602fd350-edb4-49c9-b593-d223f7449a82
2016-08-28 17:14:52 +00:00
Scott Taylor
02319efa71 Unit Tests:
* Automatically delete objects that we were created during `wpSetUpBeforeClass` - posts, comments, terms (except 1), and user (except 1)
* The amount of leftover data between tests was breathtaking - use the new function: `_delete_all_data()`
* Commit database transactions for all `TestCase`s, not just those that implement `wpSetUpBeforeClass` and `wpTearDownAfterClass`
* The tests run 10-20 seconds faster now

See #37699.


git-svn-id: https://develop.svn.wordpress.org/trunk@38398 602fd350-edb4-49c9-b593-d223f7449a82
2016-08-27 08:35:16 +00:00
Dominik Schilling (ocean90)
12cf07c669 Authentication: Allow users to log in using their email address.
Introduces `wp_authenticate_email_password()` which is hooked into `authenticate` after `wp_authenticate_username_password()`.

Props Denis-de-Bernardy, ericlewis, vhomenko, MikeHansenMe, swissspidy, ocean90.
Fixes #9568.

git-svn-id: https://develop.svn.wordpress.org/trunk@36617 602fd350-edb4-49c9-b593-d223f7449a82
2016-02-22 23:14:27 +00:00
Scott Taylor
84272ff8cd Unit Tests: since [32953], we can just use self::delete_user() instead of using if logic for Multisite.
See #30017, #33968.


git-svn-id: https://develop.svn.wordpress.org/trunk@35224 602fd350-edb4-49c9-b593-d223f7449a82
2015-10-16 19:51:32 +00:00
Scott Taylor
16d98ebf73 Unit Tests: implement setUpBeforeClass() and tearDownAfterClass() on WP_UnitTestCase. Use late static binding (plus a gross fallback for PHP 5.2) to check if wpSetUpBeforeClass() or wpTearDownAfterClass() exist on the called class, and then call it and pass a static WP_UnitTest_Factory instance via Dependency Injection, if it exists.
This makes it way easier to add fixtures, and tear them down, without needing to instantiate `WP_UnitTest_Factory` in every class - removes the need to call `commit_transaction()` in each individual class.

See #30017, #33968.


git-svn-id: https://develop.svn.wordpress.org/trunk@35186 602fd350-edb4-49c9-b593-d223f7449a82
2015-10-15 04:43:37 +00:00
Scott Taylor
9d5c7055e6 Unit Tests: Tests_Auth needs a tearDownAfterClass impl to avoid spillage.
See #30017, #33968.


git-svn-id: https://develop.svn.wordpress.org/trunk@35175 602fd350-edb4-49c9-b593-d223f7449a82
2015-10-15 01:03:16 +00:00
Scott Taylor
5fc04e0e26 Unit Tests: call commit_transaction() in Tests_Auth set up.
See #30017, #33968.


git-svn-id: https://develop.svn.wordpress.org/trunk@35174 602fd350-edb4-49c9-b593-d223f7449a82
2015-10-15 00:48:22 +00:00
Scott Taylor
c1b2a034d3 Unit Tests: wrestle performance out of Tests_Auth by cloning the same user for a majority of the tests.
See #30017, #33968.


git-svn-id: https://develop.svn.wordpress.org/trunk@35171 602fd350-edb4-49c9-b593-d223f7449a82
2015-10-15 00:10:45 +00:00
Sergey Biryukov
b935049f24 Add 'wp_verify_nonce_failed' action that fires when nonce verification fails.
props johnbillion, garza, Shelob9.
fixes #24030.

git-svn-id: https://develop.svn.wordpress.org/trunk@33744 602fd350-edb4-49c9-b593-d223f7449a82
2015-08-26 00:05:11 +00:00
Dion Hulse
5b58664439 Expire password reset links after 24 hours (by default). This causes existing password reset links to become invalid.
Props markjaquith, voldemortensen, johnbillion, MikeHansenMe, dd32
See #32429


git-svn-id: https://develop.svn.wordpress.org/trunk@33019 602fd350-edb4-49c9-b593-d223f7449a82
2015-07-01 06:32:07 +00:00
Scott Taylor
2860548f5b Set $_SERVER['REQUEST_METHOD'] for unit tests.
Props johnbillion.
Fixes #32636.


git-svn-id: https://develop.svn.wordpress.org/trunk@32785 602fd350-edb4-49c9-b593-d223f7449a82
2015-06-16 00:03:25 +00:00
ocean90
ebfa390ea1 Type cast $nonce to string in wp_verify_nonce().
props jesin.
fixes #29542.

git-svn-id: https://develop.svn.wordpress.org/trunk@30576 602fd350-edb4-49c9-b593-d223f7449a82
2014-11-26 19:18:02 +00:00
Andrew Nacin
95dbca94e1 More tests for [30466]. props xknown.
git-svn-id: https://develop.svn.wordpress.org/trunk@30471 602fd350-edb4-49c9-b593-d223f7449a82
2014-11-20 16:10:24 +00:00
Andrew Nacin
aec2f2654e Prevent high resource usage when hashing large passwords. props mdawaffe, pento
git-svn-id: https://develop.svn.wordpress.org/trunk@30466 602fd350-edb4-49c9-b593-d223f7449a82
2014-11-20 16:02:55 +00:00
Andrew Nacin
bf0272c8b1 Require a non-empty $nonce value in wp_verify_nonce().
props ocean90.
fixes #29217.


git-svn-id: https://develop.svn.wordpress.org/trunk@29620 602fd350-edb4-49c9-b593-d223f7449a82
2014-08-26 07:38:51 +00:00
Andrew Nacin
fc1438c8bc Move the trim() from wp_set_password() to inside wp_hash_password().
props rpattillo, joehoyle.
fixes #24973. see #23494.


git-svn-id: https://develop.svn.wordpress.org/trunk@25709 602fd350-edb4-49c9-b593-d223f7449a82
2013-10-07 13:53:09 +00:00
Scott Taylor
169ddb12ad Set $_SERVER['REQUEST_METHOD'] = null in Tests_Auth::setUp() to suppress undefined index notices when wp_validate_auth_cookie() is called.
See #25282.



git-svn-id: https://develop.svn.wordpress.org/trunk@25363 602fd350-edb4-49c9-b593-d223f7449a82
2013-09-11 21:37:46 +00:00
Andrew Nacin
8045afd81b Move PHPUnit tests into a tests/phpunit directory.
wp-tests-config.php can/should reside in the root of a develop checkout. `phpunit` should be run from the root.

see #25088.


git-svn-id: https://develop.svn.wordpress.org/trunk@25165 602fd350-edb4-49c9-b593-d223f7449a82
2013-08-29 18:39:34 +00:00