Changeset 3790914

Timestamp:

11/08/2026 11:35:50 AM (less than one hour ago)

Author:

deadko

Message:

Release 1.0.4

Location:

tso-login-organizer/trunk

Files:

• changelog.txt (added)
• includes/tsolo-actions.php (modified) (2 diffs)
• readme.txt (modified) (3 diffs)
• tso-login-organizer.php (modified) (2 diffs)

tso-login-organizer/trunk/includes/tsolo-actions.php

@@ -582 +582 @@
         tsolo_set_errors( $errors );
 
-        if ( $reauth ) {
+        // wp-admin sends visitors here with reauth=1 whenever it cannot validate the auth cookie. When it was
+        // opened on another host (e.g. non-www) than the one that holds the session, the session on THIS host
+        // is still valid: do not wipe it, or one stray admin link logs the user out. Same-host reauth keeps
+        // the standard behaviour (clear the cookies so the login form is shown again).
+        $request_host = isset( $_SERVER['HTTP_HOST'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitized above.
+        $cross_host   = tsolo_reauth_is_cross_host_bounce( $redirect_to, $request_host );
+        if ( tsolo_reauth_should_clear_auth_cookie( $reauth, is_user_logged_in(), $cross_host ) ) {
                 wp_clear_auth_cookie();
         }
@@ -589 +595 @@
                 tsolo_send_ajax_error( array( 'errors' => tsolo_render_errors_html( $errors ) ) );
         }
+}
+
+/**
+ * Whether a reauth=1 request is a bounce from wp-admin opened on another host (e.g. non-www).
+ *
+ * @param string $redirect_to  redirect_to request value (the wp-admin URL that bounced).
+ * @param string $request_host Host of the current (login page) request.
+ * @return bool True only when both hosts are known and differ (port ignored).
+ */
+function tsolo_reauth_is_cross_host_bounce( $redirect_to, $request_host ) {
+        $target = wp_parse_url( (string) $redirect_to, PHP_URL_HOST );
+        $here   = preg_replace( '/:\d+$/', '', strtolower( (string) $request_host ) );
+        if ( ! is_string( $target ) || '' === $target || '' === $here ) {
+                return false;
+        }
+        return strtolower( $target ) !== $here;
+}
+
+/**
+ * Whether the login page must clear the auth cookies on a reauth=1 request.
+ *
+ * Clears like WordPress core, except when the visitor already has a valid session on this host and
+ * wp-admin bounced from a different host: that session is fine and must be kept.
+ *
+ * @param bool $reauth     Whether reauth was requested.
+ * @param bool $logged_in  Whether the visitor has a valid session on this host.
+ * @param bool $cross_host Whether the bounce came from another host.
+ * @return bool
+ */
+function tsolo_reauth_should_clear_auth_cookie( $reauth, $logged_in, $cross_host = false ) {
+        return (bool) $reauth && ! ( $logged_in && $cross_host );
 }
 

tso-login-organizer/trunk/readme.txt

@@ -6 +6 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 1.0.3
+Stable tag: 1.0.4
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -102 +102 @@
 == Changelog ==
 
+= 1.0.4 =
+* Fix: opening wp-admin on another host (for example without "www") no longer logs you out; the login page keeps a session that is still valid.
+
 = 1.0.3 =
 * Improvement: avatars no longer repeat the same database lookup for commenters' emails on every avatar.
@@ -131 +134 @@
 * Front: widgets no longer get extra bottom spacing on mobile, 2FA backup codes wrap and social buttons are easier to tap.
 
-= 1.0.1 =
-* Two-factor: wrong codes are limited, a code cannot be reused, XML-RPC needs an application password and the code field also shows on wp-login.php.
-* Security: old lockout attempts are purged, and Hide wp-login.php no longer blocks when the plugin login page is not reachable.
-* Profile: the current password is needed to change email, password or turn two-factor off.
-* Password reset: an empty password now shows an error.
-* Social login and email confirmation: clear message when cancelled or when the link is invalid.
-* Module settings keep the line breaks of email texts.
-* Avatars use random file names and are removed when the user is deleted.
-* Secret keys are masked in the settings screen.
-* Default role can only be set to a role the admin may assign.
-* Uninstall also removes the new two-factor and restriction data.
-* Uninstall keeps your data unless "Delete all plugin data" is ticked in Core settings.
-* Security: choose the visitor IP source (Cloudflare, X-Forwarded-For, X-Real-IP) and list IPs that are never locked out.
-* Two-factor: users of a role that requires it are kept on their profile until they enable it.
-* Restrictions: the role box is available on every public post type and restricted content is blocked completely (login redirect or 403).
-* Email confirmation links expire after 48 hours and a new link is sent automatically; approved users get an email.
-* Social login: administrator accounts are never linked by email and the requested redirect is kept.
-* Captcha: new filter tsolo_captcha_fail_open for provider outages.
-* Mailchimp subscriptions run in the background so registration is not delayed.
-* Avatars are resized to 256 px.
-* Reserved page slugs are refused and page lookups are cached.
-* Favorites: the button recovers by itself when a cached page has an expired security token.
-
-= 1.0.0 =
-* First plugin version.
+See changelog.txt in the plugin folder for older versions.

tso-login-organizer/trunk/tso-login-organizer.php

@@ -3 +3 @@
  * Plugin Name:       TSO Login Organizer
  * Description:       Your own login, registration and password-reset pages inside your site, instead of wp-login.php, plus optional 2FA, security and social login.
- * Version:           1.0.3
+ * Version:           1.0.4
  * Author:            Tu Soporte Online
  * Author URI:        https://www.tusoporteonline.es/blog
@@ -26 +26 @@
 
 if ( ! defined( 'TSOLO_VERSION' ) ) {
-        define( 'TSOLO_VERSION', '1.0.3' );
+        define( 'TSOLO_VERSION', '1.0.4' );
 }