Skip to content

Commit 8159ede

Browse files
AnaisPantheorPantheon Robotpwtyler
authored
[SITE-5067] Fix SimpleSAMLphp warnings showing for OneLogin/internal connector users (#445)
* update readme and changelog * refactor scenarios * Add more early returns --------- Co-authored-by: Pantheon Robot <bot@getpantheon.com> Co-authored-by: Phil Tyler <phil.tyler@pantheon.io>
1 parent eab271d commit 8159ede

3 files changed

Lines changed: 68 additions & 56 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# WP SAML Auth #
2-
**Contributors:** [getpantheon](https://profiles.wordpress.org/getpantheon/), [danielbachhuber](https://profiles.wordpress.org/danielbachhuber/), [outlandish-josh](https://profiles.wordpress.org/outlandish-josh/), [jazzs3quence](https://profiles.wordpress.org/jazzs3quence/), [lcatlett](https://profiles.wordpress.org/lcatlett/)
2+
**Contributors:** [getpantheon](https://profiles.wordpress.org/getpantheon/), [danielbachhuber](https://profiles.wordpress.org/danielbachhuber/), [outlandish-josh](https://profiles.wordpress.org/outlandish-josh/), [jazzs3quence](https://profiles.wordpress.org/jazzs3quence/), [lcatlett](https://profiles.wordpress.org/lcatlett/), [AnaisPantheor](https://profiles.wordpress.org/AnaisPantheor/)
33
**Tags:** authentication, SAML
44
**Requires at least:** 6.4
55
**Tested up to:** 6.9

‎inc/class-wp-saml-auth.php‎

Lines changed: 65 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -715,7 +715,7 @@ public function action_admin_notices() {
715715
$simplesamlphp_version_status = $this->check_simplesamlphp_version( $simplesamlphp_version );
716716
$plugin_page = 'https://wordpress.org/plugins/wp-saml-auth';
717717

718-
// Using 'internal' (default) connection type.
718+
// Scenario 1 - Using 'internal' (default) connection type.
719719
if ( 'internal' === $connection_type ) {
720720
if ( file_exists( WP_SAML_AUTH_AUTOLOADER ) ) {
721721
require_once WP_SAML_AUTH_AUTOLOADER;
@@ -738,10 +738,18 @@ public function action_admin_notices() {
738738
]
739739
);
740740
}
741+
return;
742+
}
743+
744+
// Early return if not using SimpleSAMLphp connection type.
745+
if ( 'simplesamlphp' !== $connection_type ) {
746+
return;
741747
}
742748

743-
// If we have a SimpleSAMLphp version but the connection type is set, we haven't set up SimpleSAMLphp correctly.
744-
if ( ! $simplesamlphp_version && $connection_type === 'simplesamlphp' ) {
749+
// All scenarios below are for SimpleSAMLphp connection type.
750+
751+
// Scenario 2 - If we do not have a SimpleSAMLphp version, we haven't set up SimpleSAMLphp correctly.
752+
if ( ! $simplesamlphp_version ) {
745753
// Only show this notice if we're on the settings page.
746754
if ( ! isset( $_GET['page'] ) || $_GET['page'] !== 'wp-saml-auth-settings' ) {
747755
return;
@@ -761,71 +769,75 @@ public function action_admin_notices() {
761769
],
762770
]
763771
);
772+
return;
764773
}
765774

766-
// Check SimpleSAMLphp version.
767-
if ( $simplesamlphp_version !== false ) {
768-
if ( 'critical' === $simplesamlphp_version_status && $connection_type === 'simplesamlphp' ) {
769-
$min_version = self::get_option( 'critical_simplesamlphp_version' );
770-
wp_admin_notice(
771-
sprintf(
772-
// Translators: 1 is the installed version of SimpleSAMLphp, 2 is the minimum version and 3 is the most secure version.
773-
__( '<strong>Security Alert:</strong> The SimpleSAMLphp version used by the WP SAML Auth plugin (%1$s) has a critical security vulnerability (CVE-2023-26881). Please update to version %2$s or later. <a href="%3$s">Learn more</a>.', 'wp-saml-auth' ),
774-
esc_html( $simplesamlphp_version ),
775-
esc_html( $min_version ),
776-
esc_url( admin_url( 'options-general.php?page=wp-saml-auth-settings' ) )
777-
),
778-
[
779-
'type' => 'error',
780-
'dismissible' => false,
781-
'attributes' => [
782-
'data-slug' => 'wp-saml-auth',
783-
'data-type' => 'simplesamlphp-critical-vulnerability',
784-
],
785-
]
786-
);
787-
} elseif ( 'warning' === $simplesamlphp_version_status && $connection_type === 'simplesamlphp' ) {
788-
$min_version = self::get_option( 'min_simplesamlphp_version' );
789-
wp_admin_notice(
790-
sprintf(
791-
// Translators: 1 is the installed version of SimpleSAMLphp, 2 is the minimum version and 3 is the most secure version.
792-
__( '<strong>Security Recommendation:</strong> The SimpleSAMLphp version used by the WP SAML Auth plugin (%1$s) is older than the recommended secure version. Please consider updating to version %2$s or later. <a href="%3$s">Learn more</a>.', 'wp-saml-auth' ),
793-
esc_html( $simplesamlphp_version ),
794-
esc_html( $min_version ),
795-
esc_url( admin_url( 'options-general.php?page=wp-saml-auth-settings' ) )
796-
),
797-
[
798-
'type' => 'warning',
799-
'dismissible' => true,
800-
'attributes' => [
801-
'data-slug' => 'wp-saml-auth',
802-
'data-type' => 'simplesamlphp-version-warning',
803-
],
804-
]
805-
);
806-
}
807-
} elseif ( 'unknown' === $simplesamlphp_version_status && $connection_type === 'simplesamlphp' ) {
808-
// Only show this notice if we're on the settings page.
809-
if ( ! isset( $_GET['page'] ) || $_GET['page'] !== 'wp-saml-auth-settings' ) {
810-
return;
811-
}
775+
// Scenario 3 - Check SimpleSAMLphp version warnings.
776+
if ( 'critical' === $simplesamlphp_version_status ) {
777+
$min_version = self::get_option( 'critical_simplesamlphp_version' );
778+
wp_admin_notice(
779+
sprintf(
780+
// Translators: 1 is the installed version of SimpleSAMLphp, 2 is the minimum version and 3 is the most secure version.
781+
__( '<strong>Security Alert:</strong> The SimpleSAMLphp version used by the WP SAML Auth plugin (%1$s) has a critical security vulnerability (CVE-2023-26881). Please update to version %2$s or later. <a href="%3$s">Learn more</a>.', 'wp-saml-auth' ),
782+
esc_html( $simplesamlphp_version ),
783+
esc_html( $min_version ),
784+
esc_url( admin_url( 'options-general.php?page=wp-saml-auth-settings' ) )
785+
),
786+
[
787+
'type' => 'error',
788+
'dismissible' => false,
789+
'attributes' => [
790+
'data-slug' => 'wp-saml-auth',
791+
'data-type' => 'simplesamlphp-critical-vulnerability',
792+
],
793+
]
794+
);
795+
return;
796+
}
797+
798+
if ( 'warning' === $simplesamlphp_version_status ) {
799+
$min_version = self::get_option( 'min_simplesamlphp_version' );
812800
wp_admin_notice(
813801
sprintf(
814-
// Translators: 1 is the minimum recommended version of SimpleSAMLphp. 2 is a link to the WP SAML Auth settings page.
815-
__( '<strong>Warning:</strong> WP SAML Auth was unable to determine your SimpleSAMLphp version. Please ensure you are using version %1$s or later for security. <a href="%2$s">Learn more</a>.', 'wp-saml-auth' ),
816-
esc_html( self::get_option( 'min_simplesamlphp_version' ) ),
802+
// Translators: 1 is the installed version of SimpleSAMLphp, 2 is the minimum version and 3 is the most secure version.
803+
__( '<strong>Security Recommendation:</strong> The SimpleSAMLphp version used by the WP SAML Auth plugin (%1$s) is older than the recommended secure version. Please consider updating to version %2$s or later. <a href="%3$s">Learn more</a>.', 'wp-saml-auth' ),
804+
esc_html( $simplesamlphp_version ),
805+
esc_html( $min_version ),
817806
esc_url( admin_url( 'options-general.php?page=wp-saml-auth-settings' ) )
818807
),
819808
[
820809
'type' => 'warning',
821810
'dismissible' => true,
822811
'attributes' => [
823812
'data-slug' => 'wp-saml-auth',
824-
'data-type' => 'simplesamlphp-version-unknown',
813+
'data-type' => 'simplesamlphp-version-warning',
825814
],
826815
]
827816
);
817+
return;
818+
}
819+
820+
// Scenario 4 - Unable to determine SimpleSAMLphp version ("unknown").
821+
// Only show this notice if we're on the settings page.
822+
if ( ! isset( $_GET['page'] ) || $_GET['page'] !== 'wp-saml-auth-settings' ) {
823+
return;
828824
}
825+
wp_admin_notice(
826+
sprintf(
827+
// Translators: 1 is the minimum recommended version of SimpleSAMLphp. 2 is a link to the WP SAML Auth settings page.
828+
__( '<strong>Warning:</strong> WP SAML Auth was unable to determine your SimpleSAMLphp version. Please ensure you are using version %1$s or later for security. <a href="%2$s">Learn more</a>.', 'wp-saml-auth' ),
829+
esc_html( self::get_option( 'min_simplesamlphp_version' ) ),
830+
esc_url( admin_url( 'options-general.php?page=wp-saml-auth-settings' ) )
831+
),
832+
[
833+
'type' => 'warning',
834+
'dismissible' => true,
835+
'attributes' => [
836+
'data-slug' => 'wp-saml-auth',
837+
'data-type' => 'simplesamlphp-version-unknown',
838+
],
839+
]
840+
);
829841
}
830842

831843
/**

‎readme.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
=== WP SAML Auth ===
2-
Contributors: getpantheon, danielbachhuber, Outlandish Josh, jspellman, jazzs3quence
2+
Contributors: getpantheon, danielbachhuber, Outlandish Josh, jspellman, jazzs3quence, AnaisPantheor
33
Tags: authentication, SAML
44
Requires at least: 6.4
5-
Tested up to: 6.8.1
5+
Tested up to: 6.9
66
Requires PHP: 7.4
77
Stable tag: 2.2.1-dev
88
License: GPLv2 or later

0 commit comments

Comments
 (0)