IntenseWebs/WordPress
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Application Passwords: Show HTTPS required message without filtering when not enabled or not in local environment.

Browse Source 
When `add_filter( 'wp_is_application_passwords_available', '__return_false' )` exists, HTTPS requirement message is shown even if HTTPS is enabled on the site. This happens because `wp_is_application_passwords_available_for_user()` first invokes `wp_is_application_passwords_available()` which is filterable. The situation could happen if the `'wp_is_application_passwords_available_for_user'` filter returns `false`.

To fix this, the check for HTTPS (or if in a 'local' environment) is moved to a new function called `wp_is_application_passwords_supported()`. Then the return from this function is used as an OR condition for the Application Passwords section and for displaying the HTTPS required message.

Tests are included for both `wp_is_application_passwords_supported()` and `wp_is_application_passwords_available()`.

Follow-up to [51980], [51988].

Props davidbinda, SergeyBiryukov, ocean90, felipeelia, costdev, hellofromTonya.
Fixes #53658.
Built from https://develop.svn.wordpress.org/trunk@52398


git-svn-id: http://core.svn.wordpress.org/trunk@51990 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
hellofromTonya
2021-12-21 02:45:03 +00:00
parent f067011b59
commit 28b0710360
4 changed files with 21 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
wp-admin/user-edit.php
View File

@@ -733,6 +733,7 @@ endif;
</table>
<?php if ( wp_is_application_passwords_available_for_user( $user_id ) || ! wp_is_application_passwords_supported() ) : // phpcs:disable Generic.WhiteSpace.ScopeIndent ?>
<div class="application-passwords hide-if-no-js" id="application-passwords-section">
<h2><?php _e( 'Application Passwords' ); ?></h2>
<p><?php _e( 'Application passwords allow authentication via non-interactive systems, such as XML-RPC or the REST API, without providing your actual password. Application passwords can be easily revoked. They cannot be used for traditional logins to your website.' ); ?></p>
@@ -796,7 +797,7 @@ endif;
$application_passwords_list_table->display();
?>
</div>
<?php else : ?>
<?php elseif ( ! wp_is_application_passwords_supported() ) : ?>
<p><?php _e( 'The application password feature requires HTTPS, which is not enabled on this site.' ); ?></p>
<p>
<?php
@@ -809,6 +810,7 @@ endif;
</p>
<?php endif; ?>
</div>
<?php endif; // phpcs:enable Generic.WhiteSpace.ScopeIndent ?>
<?php
if ( IS_PROFILE_PAGE ) {