Feature/add http referrer allow list option #25
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit adds the Referrer Allow list option, which can be used to whitelist traffic arriving from certain referrers (internal only) which is intended to allow plugins like Nelio AB Testing to be usable on sites which use this plugin to control access to the site. internal referrer urls can contain query strings, but the input config should omit the site url, as this is set inside the plugin, to prevent external referrers from being configured. The new functionality also only accepts as valid referrer headers where the configured allowed referrer string appears at the start of the referrer header, to prevent whitelisted items being passed as parameters of a referrer to circumvent the access controls. loading an allow listed referrer url directly in the browser while unauthenticated does not allow the user to bypass the access control as when the plugin performs redirection it does not, itself, send the HTTP_REFERER header.
This commit adds a check that the config array for the referrer allow list contains valid options, as the behaviour of explode in this context means that even if the options field is empty at least one array item, of value '' with be created. Also Kahlan has been removed from the composer file and composer update rerun
jkeasley
force-pushed
the
feature/add-http-referrer-allow-list-option
branch
from
bc4790f
to
f733765
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This commit adds the Referrer Allow list option, which can be used
to whitelist traffic arriving from certain referrers (internal only)
which is intended to allow plugins like Nelio AB Testing to be usable
on sites which use this plugin to control access to the site.
internal referrer urls can contain query strings, but the input
config should omit the site url, as this is set inside the plugin,
to prevent external referrers from being configured.
The new functionality also only accepts as valid referrer headers
where the configured allowed referrer string appears at the start
of the referrer header, to prevent whitelisted items being passed
as parameters of a referrer to circumvent the access controls.
loading an allow listed referrer url directly in the browser while
unauthenticated does not allow the user to bypass the access control
as when the plugin performs redirection it does not, itself, send the
HTTP_REFERER header.
To test:
(the tests are unfortunately specific to judiciary intranet currently)
/wp-admin/admin.php?page=nelio-ab-testing-experiment-viewto the Referrers Allow List confighttp://localhost/wp-admin/admin.php?page=nelio-ab-testing-experiment-viewyou should be redirected back to the login screen.Screenshot 1, non-allow-listed referrer behaviour
Screenshot 2, referrer allow listed behaviour
