' . esc_html(
- add_query_arg(
- array(
- 'site_url' => site_url(),
- 'user_login' => $user->user_login,
- 'password' => '[------]',
- ),
- $success_url
- )
- ) . ''
- );
+ if ( 'form_post' === $success_format ) {
+ printf(
+ /* translators: %s: The URL the user is being redirected to. */
+ __( 'Your connection details will be sent to %s.' ),
+ '' . esc_html( $success_url ) . ''
+ );
+ } else {
+ printf(
+ /* translators: %s: The URL the user is being redirected to. */
+ __( 'You will be sent to %s' ),
+ '' . esc_html(
+ add_query_arg(
+ array(
+ 'site_url' => site_url(),
+ 'user_login' => $user->user_login,
+ 'password' => '[------]',
+ ),
+ $success_url
+ )
+ ) . ''
+ );
+ }
} else {
_e( 'You will be given a password to manually enter into the application in question.' );
}
diff --git a/src/wp-admin/includes/user.php b/src/wp-admin/includes/user.php
index 477ee9b5af4b7..d042314e8abad 100644
--- a/src/wp-admin/includes/user.php
+++ b/src/wp-admin/includes/user.php
@@ -643,10 +643,11 @@ function admin_created_user_email( $text ) {
* @param array $request {
* The array of request data. All arguments are optional and may be empty.
*
- * @type string $app_name The suggested name of the application.
- * @type string $app_id A UUID provided by the application to uniquely identify it.
- * @type string $success_url The URL the user will be redirected to after approving the application.
- * @type string $reject_url The URL the user will be redirected to after rejecting the application.
+ * @type string $app_name The suggested name of the application.
+ * @type string $app_id A UUID provided by the application to uniquely identify it.
+ * @type string $success_url The URL the user will be redirected to after approving the application.
+ * @type string $success_format The transport to use for the success payload. Accepts 'query' or 'form_post'.
+ * @type string $reject_url The URL the user will be redirected to after rejecting the application.
* }
* @param WP_User $user The user authorizing the application.
* @return true|WP_Error True if the request is valid, a WP_Error object contains errors if not.
@@ -674,6 +675,27 @@ function wp_is_authorize_application_password_request_valid( $request, $user ) {
}
}
+ if ( isset( $request['success_format'] ) && ! in_array( $request['success_format'], array( 'query', 'form_post' ), true ) ) {
+ $error->add(
+ 'invalid_success_format',
+ __( 'The success format must be "query" or "form_post".' )
+ );
+ }
+
+ $success_url_scheme = ! empty( $request['success_url'] ) ? wp_parse_url( $request['success_url'], PHP_URL_SCHEME ) : '';
+
+ if (
+ ! empty( $request['success_url'] ) &&
+ isset( $request['success_format'] ) &&
+ 'form_post' === $request['success_format'] &&
+ ! in_array( strtolower( (string) $success_url_scheme ), array( 'http', 'https' ), true )
+ ) {
+ $error->add(
+ 'invalid_success_format',
+ __( 'The form_post success format requires an HTTP or HTTPS success URL.' )
+ );
+ }
+
if ( ! empty( $request['app_id'] ) && ! wp_is_uuid( $request['app_id'] ) ) {
$error->add(
'invalid_app_id',
diff --git a/tests/phpunit/tests/admin/includes/user/WpIsAuthorizeApplicationPasswordRequestValid_Test.php b/tests/phpunit/tests/admin/includes/user/WpIsAuthorizeApplicationPasswordRequestValid_Test.php
index a2e1320b2a150..866629a0ef97e 100644
--- a/tests/phpunit/tests/admin/includes/user/WpIsAuthorizeApplicationPasswordRequestValid_Test.php
+++ b/tests/phpunit/tests/admin/includes/user/WpIsAuthorizeApplicationPasswordRequestValid_Test.php
@@ -93,6 +93,36 @@ public function data_is_authorize_application_password_request_valid() {
'expected_error_code' => '',
'env' => $environment_type,
);
+
+ $datasets[ $environment_type . ' and a "query" success_format' ] = array(
+ 'request' => array( 'success_format' => 'query' ),
+ 'expected_error_code' => '',
+ 'env' => $environment_type,
+ );
+
+ $datasets[ $environment_type . ' and a "form_post" success_format with an "https" scheme "success_url"' ] = array(
+ 'request' => array(
+ 'success_url' => 'https://example.org',
+ 'success_format' => 'form_post',
+ ),
+ 'expected_error_code' => '',
+ 'env' => $environment_type,
+ );
+
+ $datasets[ $environment_type . ' and an invalid success_format' ] = array(
+ 'request' => array( 'success_format' => 'invalid' ),
+ 'expected_error_code' => 'invalid_success_format',
+ 'env' => $environment_type,
+ );
+
+ $datasets[ $environment_type . ' and a "form_post" success_format with an app scheme "success_url"' ] = array(
+ 'request' => array(
+ 'success_url' => 'wordpress://example',
+ 'success_format' => 'form_post',
+ ),
+ 'expected_error_code' => 'invalid_success_format',
+ 'env' => $environment_type,
+ );
}
return $datasets;