Changeset 49109

Timestamp:

10/08/2020 10:12:02 PM (4 years ago)

Author:

TimothyBlynJacobs

Message:

REST API: Introduce Application Passwords for API authentication.

In WordPress 4.4 the REST API was first introduced. A few releases later in WordPress 4.7, the Content API endpoints were added, paving the way for Gutenberg and countless in-site experiences. In the intervening years, numerous plugins have built on top of the REST API. Many developers shared a common frustration, the lack of external authentication to the REST API.

This commit introduces Application Passwords to allow users to connect to external applications to their WordPress website. Users can generate individual passwords for each application, allowing for easy revocation and activity monitoring. An authorization flow is introduced to make the connection flow simple for users and application developers.

Application Passwords uses Basic Authentication, and by default is only available over an SSL connection.

Props georgestephanis, kasparsd, timothyblynjacobs, afercia, akkspro, andraganescu, arippberger, aristath, austyfrosty, ayesh, batmoo, bradyvercher, brianhenryie, helen, ipstenu, jeffmatson, jeffpaul, joostdevalk, joshlevinson, kadamwhite, kjbenk, koke, michael-arestad, Otto42, pekz0r, salzano, spacedmonkey, valendesigns.
Fixes #42790.

Location:

trunk

Files:

• Gruntfile.js (modified) (2 diffs)
• src/js/_enqueues/admin/application-passwords.js (added)
• src/js/_enqueues/admin/auth-app.js (added)
• src/wp-admin/authorize-application.php (added)
• src/wp-admin/css/forms.css (modified) (2 diffs)
• src/wp-admin/includes/class-wp-application-passwords-list-table.php (added)
• src/wp-admin/includes/list-table.php (modified) (1 diff)
• src/wp-admin/includes/user.php (modified) (1 diff)
• src/wp-admin/user-edit.php (modified) (3 diffs)
• src/wp-includes/class-wp-application-passwords.php (added)
• src/wp-includes/class-wp-rewrite.php (modified) (1 diff)
• src/wp-includes/default-filters.php (modified) (2 diffs)
• src/wp-includes/load.php (modified) (1 diff)
• src/wp-includes/rest-api.php (modified) (4 diffs)
• src/wp-includes/rest-api/class-wp-rest-server.php (modified) (2 diffs)
• src/wp-includes/rest-api/endpoints/class-wp-rest-application-passwords-controller.php (added)
• src/wp-includes/script-loader.php (modified) (1 diff)
• src/wp-includes/user.php (modified) (2 diffs)
• src/wp-login.php (modified) (1 diff)
• src/wp-settings.php (modified) (2 diffs)
• tests/phpunit/tests/admin/includesUser.php (added)
• tests/phpunit/tests/auth.php (modified) (3 diffs)
• tests/phpunit/tests/rest-api/rest-application-passwords-controller.php (added)
• tests/phpunit/tests/rest-api/rest-schema-setup.php (modified) (2 diffs)
• tests/qunit/fixtures/wp-api-generated.js (modified) (1 diff)

trunk/Gruntfile.js

@@ -239 +239 @@
                 files: {
                     [ WORKING_DIR + 'wp-admin/js/accordion.js' ]: [ './src/js/_enqueues/lib/accordion.js' ],
+
+
                     [ WORKING_DIR + 'wp-admin/js/code-editor.js' ]: [ './src/js/_enqueues/wp/code-editor.js' ],
                     [ WORKING_DIR + 'wp-admin/js/color-picker.js' ]: [ './src/js/_enqueues/lib/color-picker.js' ],
@@ -797 +799 @@
                 file_mappings: {
                     'src/wp-admin/js/accordion.js': 'src/js/_enqueues/lib/accordion.js',
+
+
                     'src/wp-admin/js/code-editor.js': 'src/js/_enqueues/wp/code-editor.js',
                     'src/wp-admin/js/color-picker.js': 'src/js/_enqueues/lib/color-picker.js',

trunk/src/wp-admin/css/forms.css

@@ -757 +757 @@
 }
 
-.form-table td fieldset p label { 
+.form-table td fieldset p label {
     margin-top: 0 !important;
 }
@@ -840 +840 @@
 .color-option {
     cursor: pointer;
+
+
+
+
+
 }
 

trunk/src/wp-admin/includes/list-table.php

@@ -34 +34 @@
         'WP_Theme_Install_List_Table'                 => array( 'themes', 'theme-install' ),
         'WP_Plugins_List_Table'                       => 'plugins',
+
 
         // Network Admin.

trunk/src/wp-admin/includes/user.php

@@ -595 +595 @@
     );
 }
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+

trunk/src/wp-admin/user-edit.php

@@ -27 +27 @@
 
 wp_enqueue_script( 'user-profile' );
+
+
+
+
 
 if ( IS_PROFILE_PAGE ) {
@@ -703 +707 @@
     </table>
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
         <?php
         if ( IS_PROFILE_PAGE ) {
@@ -788 +825 @@
     }
 </script>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 <?php
 require_once ABSPATH . 'wp-admin/admin-footer.php';

trunk/src/wp-includes/class-wp-rewrite.php

@@ -1510 +1510 @@
         $rules  = "<IfModule mod_rewrite.c>\n";
         $rules .= "RewriteEngine On\n";
+
         $rules .= "RewriteBase $home_root\n";
 

trunk/src/wp-includes/default-filters.php

@@ -277 +277 @@
 add_action( 'auth_cookie_bad_hash', 'rest_cookie_collect_status' );
 add_action( 'auth_cookie_valid', 'rest_cookie_collect_status' );
+
+
+
 add_filter( 'rest_authentication_errors', 'rest_cookie_check_errors', 100 );
 
@@ -428 +431 @@
 add_filter( 'authenticate', 'wp_authenticate_username_password', 20, 3 );
 add_filter( 'authenticate', 'wp_authenticate_email_password', 20, 3 );
+
 add_filter( 'authenticate', 'wp_authenticate_spam_check', 99 );
 add_filter( 'determine_current_user', 'wp_validate_auth_cookie' );
 add_filter( 'determine_current_user', 'wp_validate_logged_in_cookie', 20 );
+
 
 // Split term updates.

trunk/src/wp-includes/load.php

@@ -87 +87 @@
         $PHP_SELF            = $_SERVER['PHP_SELF'];
     }
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 }
 

trunk/src/wp-includes/rest-api.php

@@ -210 +210 @@
 
     add_filter( 'rest_pre_dispatch', 'rest_handle_options_request', 10, 3 );
+
 }
 
@@ -263 +264 @@
     // Users.
     $controller = new WP_REST_Users_Controller;
+
+
+
+
     $controller->register_routes();
 
@@ -311 +316 @@
     $controller = new WP_REST_Block_Directory_Controller();
     $controller->register_routes();
-
 }
 
@@ -1033 +1037 @@
 
     $wp_rest_auth_cookie = true;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 }
 

trunk/src/wp-includes/rest-api/class-wp-rest-server.php

@@ -224 +224 @@
      * @see WP_REST_Server::dispatch()
      *
+
+
      * @param string $path Optional. The request route. If not set, `$_SERVER['PATH_INFO']` will be used.
      *                     Default null.
@@ -229 +231 @@
      */
     public function serve_request( $path = null ) {
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
         $content_type = isset( $_GET['_jsonp'] ) ? 'application/javascript' : 'application/json';
         $this->send_header( 'Content-Type', $content_type . '; charset=' . get_option( 'blog_charset' ) );

trunk/src/wp-includes/script-loader.php

@@ -1068 +1068 @@
     $scripts->set_translations( 'password-strength-meter' );
 
+
+
+
+
+
+
     $scripts->add( 'user-profile', "/wp-admin/js/user-profile$suffix.js", array( 'jquery', 'password-strength-meter', 'wp-util' ), false, 1 );
     $scripts->set_translations( 'user-profile' );

trunk/src/wp-includes/user.php

@@ -296 +296 @@
 
     return $user;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 }
 
@@ -3924 +4094 @@
     return new WP_User_Request( $post );
 }
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+

trunk/src/wp-login.php

@@ -1372 +1372 @@
             } elseif ( WP_Recovery_Mode_Link_Service::LOGIN_ACTION_ENTERED === $action ) {
                 $errors->add( 'enter_recovery_mode', __( 'Recovery Mode Initialized. Please log in to continue.' ), 'message' );
+
+
+
+
+
+
+
+
+
+
+
+
+
             }
         }

trunk/src/wp-settings.php

@@ -237 +237 @@
 require ABSPATH . WPINC . '/nav-menu-template.php';
 require ABSPATH . WPINC . '/admin-bar.php';
+
 require ABSPATH . WPINC . '/rest-api.php';
 require ABSPATH . WPINC . '/rest-api/class-wp-rest-server.php';
@@ -260 +261 @@
 require ABSPATH . WPINC . '/rest-api/endpoints/class-wp-rest-plugins-controller.php';
 require ABSPATH . WPINC . '/rest-api/endpoints/class-wp-rest-block-directory-controller.php';
+
 require ABSPATH . WPINC . '/rest-api/fields/class-wp-rest-meta-fields.php';
 require ABSPATH . WPINC . '/rest-api/fields/class-wp-rest-comment-meta-fields.php';

trunk/tests/phpunit/tests/auth.php

@@ -7 +7 @@
 class Tests_Auth extends WP_UnitTestCase {
     protected $user;
+
+
+
+
     protected static $_user;
     protected static $user_id;
@@ -34 +38 @@
         $this->user = clone self::$_user;
         wp_set_current_user( self::$user_id );
+
+
+
+
+
+
+
     }
 
@@ -415 +426 @@
     }
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 }

trunk/tests/phpunit/tests/rest-api/rest-schema-setup.php

@@ -119 +119 @@
             '/wp/v2/users/(?P<id>[\\d]+)',
             '/wp/v2/users/me',
+
+
             '/wp/v2/comments',
             '/wp/v2/comments/(?P<id>[\\d]+)',
@@ -133 +135 @@
         );
 
-        $this->assertSame( $expected_routes, $routes );
+        $this->assertSame( $expected_routes, $routes );
     }
 

trunk/tests/qunit/fixtures/wp-api-generated.js

@@ -3985 +3985 @@
                 "self": "http://example.org/index.php?rest_route=/wp/v2/users/me"
             }
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
         },
         "/wp/v2/comments": {