Changeset 3747553

Timestamp:

10/15/2026 03:36:44 AM (3 weeks ago)

Author:

someguy9

Message:

1.6.3

Location:

rightblogger

Files:

• tags/1.6.3 (copied) (copied from rightblogger/trunk )
• tags/1.6.3/readme.txt (modified) (2 diffs)
• tags/1.6.3/rightblogger.php (modified) (7 diffs)
• tags/1.6.3/uninstall.php (modified) (1 diff)
• trunk/readme.txt (modified) (2 diffs)
• trunk/rightblogger.php (modified) (7 diffs)
• trunk/uninstall.php (modified) (1 diff)

rightblogger/tags/1.6.3/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 1.6.2
+Stable tag: 1.6.3
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -114 +114 @@
 
 == Changelog ==
+
+= 1.6.3 =
+* Fixed: Connecting no longer fails with "Security check failed" and leaves the site unconnected when WordPress asks you to log in again on the way back from RightBlogger.
 
 = 1.6.2 =

rightblogger/tags/1.6.3/rightblogger.php

@@ -4 +4 @@
  * Plugin URI: https://rightblogger.com/wordpress
  * Description: Connect your WordPress site to RightBlogger to publish AI-generated content directly.
- * Version: 1.6.2
+ * Version: 1.6.3
  * Author: RightBlogger
  * Author URI: https://rightblogger.com
@@ -20 +20 @@
 
 // Plugin constants
-define('RIGHTBLOGGER_VERSION', '1.6.2');
+define('RIGHTBLOGGER_VERSION', '1.6.3');
 define('RIGHTBLOGGER_PLUGIN_DIR', plugin_dir_path(__FILE__));
 define('RIGHTBLOGGER_PLUGIN_URL', plugin_dir_url(__FILE__));
@@ -67 +67 @@
     const OPTION_BLOCK_ENABLED = 'rightblogger_studio_block_enabled';
 
+    // Per-user (per-site on multisite) token that rides on the connect
+    // return_url beside the nonce. See handle_callback() for why.
+    const USER_OPTION_CONNECT_STATE = 'rightblogger_connect_state';
+
     /**
      * Instance
      */
     private static $instance = null;
-    
+
     /**
      * Get instance
@@ -323 +327 @@
         // that key unlocks the publish endpoints, which save unfiltered HTML.
         $nonce = isset($_GET['_wpnonce']) ? sanitize_text_field(wp_unslash($_GET['_wpnonce'])) : '';
-        if (!wp_verify_nonce($nonce, 'rightblogger_callback')) {
+        $state = isset($_GET['rb_state']) ? sanitize_text_field(wp_unslash($_GET['rb_state'])) : '';
+        // The nonce is bound to the login session that clicked Connect, so a
+        // site that makes the admin log in again on the way back (cookie
+        // hardening, an expired session) fails it on a genuine connection and
+        // RightBlogger is left holding a key the site never saved. The state
+        // token is bound to the user instead and survives a re-login. Either
+        // proves this admin started the flow; a forged link carries neither.
+        if (!wp_verify_nonce($nonce, 'rightblogger_callback') && !$this->connect_state_matches($state)) {
             add_settings_error(
                 'rightblogger_messages',
@@ -332 +343 @@
             return;
         }
-        
+        // One use: a return_url left in history can't connect the site later.
+        delete_user_option(get_current_user_id(), self::USER_OPTION_CONNECT_STATE);
+
         $status = sanitize_text_field(wp_unslash($_GET['status']));
         
@@ -565 +578 @@
         // Format: rbwp_64hexchars
         return (bool) preg_match('/^rbwp_[a-f0-9]{64}$/', $key);
+    }
+
+    /**
+     * The current user's connect state token, minted on demand. Reused while it
+     * has an hour left, so two open settings tabs agree and a click is never
+     * minutes from expiry, then rotated. handle_callback() deletes it on use.
+     */
+    private function connect_state_token() {
+        $user_id = get_current_user_id();
+        $state = get_user_option(self::USER_OPTION_CONNECT_STATE, $user_id);
+        if (!is_array($state) || empty($state['token']) || empty($state['expires'])
+            || (int) $state['expires'] - time() < HOUR_IN_SECONDS) {
+            $state = array(
+                'token'   => wp_generate_password(32, false),
+                'expires' => time() + DAY_IN_SECONDS,
+            );
+            update_user_option($user_id, self::USER_OPTION_CONNECT_STATE, $state);
+        }
+        return $state['token'];
+    }
+
+    /**
+     * Whether $token is the current user's unexpired connect state token.
+     */
+    private function connect_state_matches($token) {
+        if (!is_string($token) || $token === '') {
+            return false;
+        }
+        $state = get_user_option(self::USER_OPTION_CONNECT_STATE, get_current_user_id());
+        return is_array($state) && !empty($state['token']) && !empty($state['expires'])
+            && (int) $state['expires'] > time()
+            && hash_equals((string) $state['token'], $token);
     }
     
@@ -1140 +1185 @@
 
         // Build connect URL. RightBlogger appends the connection params to
-        // return_url and keeps its existing query, so the nonce comes back with
-        // them and handle_callback() can tell this admin started the flow.
+        // return_url and keeps its existing query, so the nonce and state token
+        // come back with them and handle_callback() can tell this admin started
+        // the flow.
         $return_url = add_query_arg(
-            '_wpnonce',
-            wp_create_nonce('rightblogger_callback'),
+            array(
+                '_wpnonce' => wp_create_nonce('rightblogger_callback'),
+                'rb_state' => $this->connect_state_token(),
+            ),
             admin_url('options-general.php?page=rightblogger')
         );

rightblogger/tags/1.6.3/uninstall.php

@@ -29 +29 @@
 delete_transient('rightblogger_conn_status');
 
+// Connect state tokens are user options, stored per site under the blog prefix.
+global $wpdb;
+delete_metadata('user', 0, $wpdb->get_blog_prefix() . 'rightblogger_connect_state', '', true);
+

rightblogger/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 1.6.2
+Stable tag: 1.6.3
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -114 +114 @@
 
 == Changelog ==
+
+= 1.6.3 =
+* Fixed: Connecting no longer fails with "Security check failed" and leaves the site unconnected when WordPress asks you to log in again on the way back from RightBlogger.
 
 = 1.6.2 =

rightblogger/trunk/rightblogger.php

@@ -4 +4 @@
  * Plugin URI: https://rightblogger.com/wordpress
  * Description: Connect your WordPress site to RightBlogger to publish AI-generated content directly.
- * Version: 1.6.2
+ * Version: 1.6.3
  * Author: RightBlogger
  * Author URI: https://rightblogger.com
@@ -20 +20 @@
 
 // Plugin constants
-define('RIGHTBLOGGER_VERSION', '1.6.2');
+define('RIGHTBLOGGER_VERSION', '1.6.3');
 define('RIGHTBLOGGER_PLUGIN_DIR', plugin_dir_path(__FILE__));
 define('RIGHTBLOGGER_PLUGIN_URL', plugin_dir_url(__FILE__));
@@ -67 +67 @@
     const OPTION_BLOCK_ENABLED = 'rightblogger_studio_block_enabled';
 
+    // Per-user (per-site on multisite) token that rides on the connect
+    // return_url beside the nonce. See handle_callback() for why.
+    const USER_OPTION_CONNECT_STATE = 'rightblogger_connect_state';
+
     /**
      * Instance
      */
     private static $instance = null;
-    
+
     /**
      * Get instance
@@ -323 +327 @@
         // that key unlocks the publish endpoints, which save unfiltered HTML.
         $nonce = isset($_GET['_wpnonce']) ? sanitize_text_field(wp_unslash($_GET['_wpnonce'])) : '';
-        if (!wp_verify_nonce($nonce, 'rightblogger_callback')) {
+        $state = isset($_GET['rb_state']) ? sanitize_text_field(wp_unslash($_GET['rb_state'])) : '';
+        // The nonce is bound to the login session that clicked Connect, so a
+        // site that makes the admin log in again on the way back (cookie
+        // hardening, an expired session) fails it on a genuine connection and
+        // RightBlogger is left holding a key the site never saved. The state
+        // token is bound to the user instead and survives a re-login. Either
+        // proves this admin started the flow; a forged link carries neither.
+        if (!wp_verify_nonce($nonce, 'rightblogger_callback') && !$this->connect_state_matches($state)) {
             add_settings_error(
                 'rightblogger_messages',
@@ -332 +343 @@
             return;
         }
-        
+        // One use: a return_url left in history can't connect the site later.
+        delete_user_option(get_current_user_id(), self::USER_OPTION_CONNECT_STATE);
+
         $status = sanitize_text_field(wp_unslash($_GET['status']));
         
@@ -565 +578 @@
         // Format: rbwp_64hexchars
         return (bool) preg_match('/^rbwp_[a-f0-9]{64}$/', $key);
+    }
+
+    /**
+     * The current user's connect state token, minted on demand. Reused while it
+     * has an hour left, so two open settings tabs agree and a click is never
+     * minutes from expiry, then rotated. handle_callback() deletes it on use.
+     */
+    private function connect_state_token() {
+        $user_id = get_current_user_id();
+        $state = get_user_option(self::USER_OPTION_CONNECT_STATE, $user_id);
+        if (!is_array($state) || empty($state['token']) || empty($state['expires'])
+            || (int) $state['expires'] - time() < HOUR_IN_SECONDS) {
+            $state = array(
+                'token'   => wp_generate_password(32, false),
+                'expires' => time() + DAY_IN_SECONDS,
+            );
+            update_user_option($user_id, self::USER_OPTION_CONNECT_STATE, $state);
+        }
+        return $state['token'];
+    }
+
+    /**
+     * Whether $token is the current user's unexpired connect state token.
+     */
+    private function connect_state_matches($token) {
+        if (!is_string($token) || $token === '') {
+            return false;
+        }
+        $state = get_user_option(self::USER_OPTION_CONNECT_STATE, get_current_user_id());
+        return is_array($state) && !empty($state['token']) && !empty($state['expires'])
+            && (int) $state['expires'] > time()
+            && hash_equals((string) $state['token'], $token);
     }
     
@@ -1140 +1185 @@
 
         // Build connect URL. RightBlogger appends the connection params to
-        // return_url and keeps its existing query, so the nonce comes back with
-        // them and handle_callback() can tell this admin started the flow.
+        // return_url and keeps its existing query, so the nonce and state token
+        // come back with them and handle_callback() can tell this admin started
+        // the flow.
         $return_url = add_query_arg(
-            '_wpnonce',
-            wp_create_nonce('rightblogger_callback'),
+            array(
+                '_wpnonce' => wp_create_nonce('rightblogger_callback'),
+                'rb_state' => $this->connect_state_token(),
+            ),
             admin_url('options-general.php?page=rightblogger')
         );

rightblogger/trunk/uninstall.php

@@ -29 +29 @@
 delete_transient('rightblogger_conn_status');
 
+// Connect state tokens are user options, stored per site under the blog prefix.
+global $wpdb;
+delete_metadata('user', 0, $wpdb->get_blog_prefix() . 'rightblogger_connect_state', '', true);
+