EIG-SSO - Version 1.0

Version Description

Release Info

Developer	eig
Plugin	EIG-SSO
Version	1.0
Comparing to
See all releases

Version 1.0

Files changed (3) hide show

LICENSE.md +264 -0
eig-sso.php +191 -0
readme.txt +55 -0

LICENSE.md ADDED Viewed

	@@ -0,0 +1,264 @@


1	+ The GNU General Public License, Version 2, June 1991 (GPLv2)
2	+ ============================================================
3	+
4	+ > Copyright (C) 1989, 1991 Free Software Foundation, Inc.
5	+ > 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
6	+
7	+ Everyone is permitted to copy and distribute verbatim copies of this license
8	+ document, but changing it is not allowed.
9	+
10	+
11	+ Preamble
12	+ --------
13	+
14	+ The licenses for most software are designed to take away your freedom to share
15	+ and change it. By contrast, the GNU General Public License is intended to
16	+ guarantee your freedom to share and change free software--to make sure the
17	+ software is free for all its users. This General Public License applies to most
18	+ of the Free Software Foundation's software and to any other program whose
19	+ authors commit to using it. (Some other Free Software Foundation software is
20	+ covered by the GNU Library General Public License instead.) You can apply it to
21	+ your programs, too.
22	+
23	+ When we speak of free software, we are referring to freedom, not price. Our
24	+ General Public Licenses are designed to make sure that you have the freedom to
25	+ distribute copies of free software (and charge for this service if you wish),
26	+ that you receive source code or can get it if you want it, that you can change
27	+ the software or use pieces of it in new free programs; and that you know you can
28	+ do these things.
29	+
30	+ To protect your rights, we need to make restrictions that forbid anyone to deny
31	+ you these rights or to ask you to surrender the rights. These restrictions
32	+ translate to certain responsibilities for you if you distribute copies of the
33	+ software, or if you modify it.
34	+
35	+ For example, if you distribute copies of such a program, whether gratis or for a
36	+ fee, you must give the recipients all the rights that you have. You must make
37	+ sure that they, too, receive or can get the source code. And you must show them
38	+ these terms so they know their rights.
39	+
40	+ We protect your rights with two steps: (1) copyright the software, and (2) offer
41	+ you this license which gives you legal permission to copy, distribute and/or
42	+ modify the software.
43	+
44	+ Also, for each author's protection and ours, we want to make certain that
45	+ everyone understands that there is no warranty for this free software. If the
46	+ software is modified by someone else and passed on, we want its recipients to
47	+ know that what they have is not the original, so that any problems introduced by
48	+ others will not reflect on the original authors' reputations.
49	+
50	+ Finally, any free program is threatened constantly by software patents. We wish
51	+ to avoid the danger that redistributors of a free program will individually
52	+ obtain patent licenses, in effect making the program proprietary. To prevent
53	+ this, we have made it clear that any patent must be licensed for everyone's free
54	+ use or not licensed at all.
55	+
56	+ The precise terms and conditions for copying, distribution and modification
57	+ follow.
58	+
59	+
60	+ Terms And Conditions For Copying, Distribution And Modification
61	+ ---------------------------------------------------------------
62	+
63	+ 0. This License applies to any program or other work which contains a notice
64	+ placed by the copyright holder saying it may be distributed under the terms of
65	+ this General Public License. The "Program", below, refers to any such program or
66	+ work, and a "work based on the Program" means either the Program or any
67	+ derivative work under copyright law: that is to say, a work containing the
68	+ Program or a portion of it, either verbatim or with modifications and/or
69	+ translated into another language. (Hereinafter, translation is included without
70	+ limitation in the term "modification".) Each licensee is addressed as "you".
71	+
72	+ Activities other than copying, distribution and modification are not covered by
73	+ this License; they are outside its scope. The act of running the Program is not
74	+ restricted, and the output from the Program is covered only if its contents
75	+ constitute a work based on the Program (independent of having been made by
76	+ running the Program). Whether that is true depends on what the Program does.
77	+
78	+ 1. You may copy and distribute verbatim copies of the Program's source code
79	+ as you receive it, in any medium, provided that you conspicuously and
80	+ appropriately publish on each copy an appropriate copyright notice and
81	+ disclaimer of warranty; keep intact all the notices that refer to this License
82	+ and to the absence of any warranty; and give any other recipients of the Program
83	+ a copy of this License along with the Program.
84	+
85	+ You may charge a fee for the physical act of transferring a copy, and you may at
86	+ your option offer warranty protection in exchange for a fee.
87	+
88	+ 2. You may modify your copy or copies of the Program or any portion of it,
89	+ thus forming a work based on the Program, and copy and distribute such
90	+ modifications or work under the terms of Section 1 above, provided that you also
91	+ meet all of these conditions:
92	+
93	+ * a) You must cause the modified files to carry prominent notices stating
94	+ that you changed the files and the date of any change.
95	+
96	+ * b) You must cause any work that you distribute or publish, that in whole
97	+ or in part contains or is derived from the Program or any part thereof, to
98	+ be licensed as a whole at no charge to all third parties under the terms of
99	+ this License.
100	+
101	+ * c) If the modified program normally reads commands interactively when
102	+ run, you must cause it, when started running for such interactive use in the
103	+ most ordinary way, to print or display an announcement including an
104	+ appropriate copyright notice and a notice that there is no warranty (or
105	+ else, saying that you provide a warranty) and that users may redistribute
106	+ the program under these conditions, and telling the user how to view a copy
107	+ of this License. (Exception: if the Program itself is interactive but does
108	+ not normally print such an announcement, your work based on the Program is
109	+ not required to print an announcement.)
110	+
111	+ These requirements apply to the modified work as a whole. If identifiable
112	+ sections of that work are not derived from the Program, and can be reasonably
113	+ considered independent and separate works in themselves, then this License, and
114	+ its terms, do not apply to those sections when you distribute them as separate
115	+ works. But when you distribute the same sections as part of a whole which is a
116	+ work based on the Program, the distribution of the whole must be on the terms of
117	+ this License, whose permissions for other licensees extend to the entire whole,
118	+ and thus to each and every part regardless of who wrote it.
119	+
120	+ Thus, it is not the intent of this section to claim rights or contest your
121	+ rights to work written entirely by you; rather, the intent is to exercise the
122	+ right to control the distribution of derivative or collective works based on the
123	+ Program.
124	+
125	+ In addition, mere aggregation of another work not based on the Program with the
126	+ Program (or with a work based on the Program) on a volume of a storage or
127	+ distribution medium does not bring the other work under the scope of this
128	+ License.
129	+
130	+ 3. You may copy and distribute the Program (or a work based on it, under
131	+ Section 2) in object code or executable form under the terms of Sections 1 and 2
132	+ above provided that you also do one of the following:
133	+
134	+ * a) Accompany it with the complete corresponding machine-readable source
135	+ code, which must be distributed under the terms of Sections 1 and 2 above on
136	+ a medium customarily used for software interchange; or,
137	+
138	+ * b) Accompany it with a written offer, valid for at least three years, to
139	+ give any third party, for a charge no more than your cost of physically
140	+ performing source distribution, a complete machine-readable copy of the
141	+ corresponding source code, to be distributed under the terms of Sections 1
142	+ and 2 above on a medium customarily used for software interchange; or,
143	+
144	+ * c) Accompany it with the information you received as to the offer to
145	+ distribute corresponding source code. (This alternative is allowed only for
146	+ noncommercial distribution and only if you received the program in object
147	+ code or executable form with such an offer, in accord with Subsection b
148	+ above.)
149	+
150	+ The source code for a work means the preferred form of the work for making
151	+ modifications to it. For an executable work, complete source code means all the
152	+ source code for all modules it contains, plus any associated interface
153	+ definition files, plus the scripts used to control compilation and installation
154	+ of the executable. However, as a special exception, the source code distributed
155	+ need not include anything that is normally distributed (in either source or
156	+ binary form) with the major components (compiler, kernel, and so on) of the
157	+ operating system on which the executable runs, unless that component itself
158	+ accompanies the executable.
159	+
160	+ If distribution of executable or object code is made by offering access to copy
161	+ from a designated place, then offering equivalent access to copy the source code
162	+ from the same place counts as distribution of the source code, even though third
163	+ parties are not compelled to copy the source along with the object code.
164	+
165	+ 4. You may not copy, modify, sublicense, or distribute the Program except as
166	+ expressly provided under this License. Any attempt otherwise to copy, modify,
167	+ sublicense or distribute the Program is void, and will automatically terminate
168	+ your rights under this License. However, parties who have received copies, or
169	+ rights, from you under this License will not have their licenses terminated so
170	+ long as such parties remain in full compliance.
171	+
172	+ 5. You are not required to accept this License, since you have not signed
173	+ it. However, nothing else grants you permission to modify or distribute the
174	+ Program or its derivative works. These actions are prohibited by law if you do
175	+ not accept this License. Therefore, by modifying or distributing the Program (or
176	+ any work based on the Program), you indicate your acceptance of this License to
177	+ do so, and all its terms and conditions for copying, distributing or modifying
178	+ the Program or works based on it.
179	+
180	+ 6. Each time you redistribute the Program (or any work based on the
181	+ Program), the recipient automatically receives a license from the original
182	+ licensor to copy, distribute or modify the Program subject to these terms and
183	+ conditions. You may not impose any further restrictions on the recipients'
184	+ exercise of the rights granted herein. You are not responsible for enforcing
185	+ compliance by third parties to this License.
186	+
187	+ 7. If, as a consequence of a court judgment or allegation of patent
188	+ infringement or for any other reason (not limited to patent issues), conditions
189	+ are imposed on you (whether by court order, agreement or otherwise) that
190	+ contradict the conditions of this License, they do not excuse you from the
191	+ conditions of this License. If you cannot distribute so as to satisfy
192	+ simultaneously your obligations under this License and any other pertinent
193	+ obligations, then as a consequence you may not distribute the Program at all.
194	+ For example, if a patent license would not permit royalty-free redistribution of
195	+ the Program by all those who receive copies directly or indirectly through you,
196	+ then the only way you could satisfy both it and this License would be to refrain
197	+ entirely from distribution of the Program.
198	+
199	+ If any portion of this section is held invalid or unenforceable under any
200	+ particular circumstance, the balance of the section is intended to apply and the
201	+ section as a whole is intended to apply in other circumstances.
202	+
203	+ It is not the purpose of this section to induce you to infringe any patents or
204	+ other property right claims or to contest validity of any such claims; this
205	+ section has the sole purpose of protecting the integrity of the free software
206	+ distribution system, which is implemented by public license practices. Many
207	+ people have made generous contributions to the wide range of software
208	+ distributed through that system in reliance on consistent application of that
209	+ system; it is up to the author/donor to decide if he or she is willing to
210	+ distribute software through any other system and a licensee cannot impose that
211	+ choice.
212	+
213	+ This section is intended to make thoroughly clear what is believed to be a
214	+ consequence of the rest of this License.
215	+
216	+ 8. If the distribution and/or use of the Program is restricted in certain
217	+ countries either by patents or by copyrighted interfaces, the original copyright
218	+ holder who places the Program under this License may add an explicit
219	+ geographical distribution limitation excluding those countries, so that
220	+ distribution is permitted only in or among countries not thus excluded. In such
221	+ case, this License incorporates the limitation as if written in the body of this
222	+ License.
223	+
224	+ 9. The Free Software Foundation may publish revised and/or new versions of
225	+ the General Public License from time to time. Such new versions will be similar
226	+ in spirit to the present version, but may differ in detail to address new
227	+ problems or concerns.
228	+
229	+ Each version is given a distinguishing version number. If the Program specifies
230	+ a version number of this License which applies to it and "any later version",
231	+ you have the option of following the terms and conditions either of that version
232	+ or of any later version published by the Free Software Foundation. If the
233	+ Program does not specify a version number of this License, you may choose any
234	+ version ever published by the Free Software Foundation.
235	+
236	+ 10. If you wish to incorporate parts of the Program into other free programs
237	+ whose distribution conditions are different, write to the author to ask for
238	+ permission. For software which is copyrighted by the Free Software Foundation,
239	+ write to the Free Software Foundation; we sometimes make exceptions for this.
240	+ Our decision will be guided by the two goals of preserving the free status of
241	+ all derivatives of our free software and of promoting the sharing and reuse of
242	+ software generally.
243	+
244	+
245	+ No Warranty
246	+ -----------
247	+
248	+ 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR
249	+ THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE
250	+ STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM
251	+ "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING,
252	+ BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
253	+ PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
254	+ PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
255	+ ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
256	+
257	+ 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
258	+ WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE
259	+ THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
260	+ GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR
261	+ INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA
262	+ BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
263	+ FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER
264	+ OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

eig-sso.php ADDED Viewed

	@@ -0,0 +1,191 @@


1	+ <?php
2	+ /*
3	+ Plugin Name: EIG-SSO
4	+ Version: 1.0
5	+ Description: Securely log in to WordPress from Control Panel without needing a username and password.
6	+ Author: Endurance International Group
7	+ Author URI: http://endurance.com/
8	+ License: GPL2
9	+ */
10	+
11	+ function eigsso_activate() {
12	+ global $wpdb;
13	+
14	+ $table = $wpdb->prefix . 'eig_sso';
15	+
16	+ $q = "CREATE TABLE $table (
17	+ offer VARCHAR(255) DEFAULT '' NOT NULL,
18	+ expires int(11) DEFAULT 0 NOT NULL,
19	+ UNIQUE KEY offer (offer)
20	+ );";
21	+
22	+ require_once( ABSPATH . 'wp-admin/includes/upgrade.php' );
23	+ dbDelta( $q );
24	+ }
25	+ register_activation_hook( __FILE__, 'eigsso_activate' );
26	+
27	+ function eigsso_deactivate() {
28	+ eigsso_clear_offers();
29	+ }
30	+ register_deactivation_hook( __FILE__, 'eigsso_deactivate' );
31	+
32	+ function eigsso_detect_trigger() {
33	+ if ( ! isset( $_GET['eigsso_nonce'] ) \|\| ! isset( $_GET['eigsso_salt'] ) ) {
34	+ return;
35	+ }
36	+
37	+ $nonce = $_GET['eigsso_nonce'];
38	+ $salt = $_GET['eigsso_salt'];
39	+
40	+ if ( eigsso_check_offer( $nonce, $salt ) ) {
41	+ eigsso_accept_offer();
42	+ }
43	+
44	+ /* if the mysql user doesn't have privileges eigsso_accept_offer will not
45	+ redirect and drop into this case. */
46	+ wp_safe_redirect( wp_login_url() );
47	+ exit;
48	+ }
49	+ add_action( 'init', 'eigsso_detect_trigger' );
50	+
51	+ function eigsso_check_offer($nonce, $salt) {
52	+ if ( empty( $nonce ) \|\| empty( $salt ) ) {
53	+ eigsso_set_failed_attempts( eigsso_get_failed_attempts() + 1 );
54	+ return false;
55	+ }
56	+
57	+ if ( eigsso_locked_out() ) {
58	+ return false;
59	+ }
60	+
61	+ global $wpdb;
62	+
63	+ $hash = base64_encode( hash( 'sha256', $nonce . $salt, true ) );
64	+ $now = time();
65	+ $expiration = $now + 20;
66	+
67	+ $table = $wpdb->prefix . 'eig_sso';
68	+
69	+ /* wp doesn't support SELECT 1, but 1=1 is an alias to TRUE */
70	+ $res = $wpdb->get_var(
71	+ $wpdb->prepare(
72	+ "SELECT 1=1 FROM $table
73	+ WHERE offer = %s AND expires >= %s AND expires < %s",
74	+ $hash, $now, $expiration
75	+ )
76	+ );
77	+
78	+ if ( null !== $res ) {
79	+ return true;
80	+ }
81	+
82	+ eigsso_set_failed_attempts( eigsso_get_failed_attempts() + 1 );
83	+ return false;
84	+ }
85	+
86	+ function eigsso_accept_offer() {
87	+ if ( true === eigsso_clear_offers() ) {
88	+ if ( is_user_logged_in() ) {
89	+ wp_logout();
90	+ }
91	+
92	+ $args = array(
93	+ 'role' => 'administrator',
94	+ 'fields' => array( 'ID', 'user_login' ),
95	+ 'number' => 1, /* LIMIT 1 */
96	+ );
97	+ $admins = get_users( $args );
98	+
99	+ if ( empty( $admins ) ) {
100	+ return false;
101	+ }
102	+
103	+ $admin = $admins[0];
104	+
105	+ wp_set_current_user( $admin->ID, $admin->user_login );
106	+ wp_set_auth_cookie( $admin->ID );
107	+ do_action( 'wp_login', $admin->user_login );
108	+
109	+ wp_safe_redirect( admin_url() );
110	+ exit;
111	+ }
112	+
113	+ return false;
114	+ }
115	+
116	+ function eigsso_clear_offers() {
117	+ global $wpdb;
118	+
119	+ $table = $wpdb->prefix . 'eig_sso';
120	+ $res = $wpdb->query( "TRUNCATE TABLE $table" );
121	+
122	+ /* if the user doesn't have truncate privileges */
123	+ if ( true !== $res ) {
124	+ $res = $wpdb->query( "DELETE FROM $table WHERE 1" );
125	+ }
126	+
127	+ return $res;
128	+ }
129	+
130	+ function eigsso_uninstall() {
131	+ if ( ! defined( 'WP_UNINSTALL_PLUGIN' ) ) {
132	+ exit;
133	+ }
134	+
135	+ global $wpdb;
136	+
137	+ $table = $wpdb->prefix . 'eig_sso';
138	+
139	+ $wpdb->query( "DROP TABLE $table" );
140	+ }
141	+ register_uninstall_hook( __FILE__, 'eigsso_uninstall' );
142	+
143	+ function eigsso_user_identifier($prefix) {
144	+ if ( null === $prefix ) {
145	+ $prefix = '';
146	+ }
147	+
148	+ return 'eigsso_' . $prefix . '_' . $_SERVER['REMOTE_ADDR'];
149	+ }
150	+
151	+ function eigsso_get_failed_attempts() {
152	+ $id = eigsso_user_identifier( 'failed_attempts' );
153	+
154	+ $attempts_n = get_transient( $id, 0 );
155	+
156	+ return $attempts_n;
157	+ }
158	+
159	+ function eigsso_set_failed_attempts($attempts_n) {
160	+ if ( ! is_int($attempts_n) ) {
161	+ return false;
162	+ }
163	+
164	+ $id = eigsso_user_identifier( 'failed_attempts' );
165	+
166	+ return set_transient( $id, $attempts_n, 60 * 60 * 3 );
167	+ }
168	+
169	+ function eigsso_locked_out() {
170	+ return 5 <= eigsso_get_failed_attempts();
171	+ }
172	+
173	+ /*
174	+ eig-sso.php - Defines SSO offer functionality and hooks into WordPress events.
175	+ Copyright (C) 2014 Endurance International Group
176	+
177	+ This program is free software; you can redistribute it and/or
178	+ modify it under the terms of the GNU General Public License
179	+ as published by the Free Software Foundation; either version 2
180	+ of the License, or (at your option) any later version.
181	+
182	+ This program is distributed in the hope that it will be useful,
183	+ but WITHOUT ANY WARRANTY; without even the implied warranty of
184	+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
185	+ GNU General Public License for more details.
186	+
187	+ You should have received a copy of the GNU General Public License
188	+ along with this program; if not, write to the Free Software
189	+ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
190	+ */
191	+ ?>

readme.txt ADDED Viewed

	@@ -0,0 +1,55 @@


1	+ === EIG-SSO ===
2	+ Contributors: bcorey, eig
3	+ Tags: sso, single sign-on
4	+ Requires at least: 3.3
5	+ Tested up to: 3.9
6	+ Stable tag: 1.0
7	+ License: GPLv2 or later
8	+ License URI: http://www.gnu.org/licenses/gpl-2.0.html
9	+
10	+ Allows customers of Endurance International Group to sign on to WordPress through the vDeck Control Panel.
11	+
12	+ == Description ==
13	+
14	+ EIG-SSO is a single sign on plugin that allows customers of Endurance International Group brands (FatCow, iPage, IPOWER, and others) to sign on to their WordPress installations without needing to remember an additional username and password.
15	+
16	+ When installed and activated, this plugin will detect single sign on (SSO) attempts when requested by an authenticated user. On the Control Panel side, the user need only click on the "Launch WordPress" button to be signed in to their WordPress installation.
17	+
18	+ == Installation ==
19	+
20	+ 1. Upload `eig-sso.php` to the `/wp-content/plugins/` directory
21	+ 2. Activate the plugin through the 'Plugins' menu in WordPress
22	+
23	+ == Frequently asked questions ==
24	+
25	+ = How do I configure single sign-on (SSO)? =
26	+
27	+ This plugin creates and drops its database table on install and uninstall, respectively. As it relies on data created by the vDeck Control Panel, no user configuration is necessary. If you wish to disable SSO functionality, you may deactivate the plugin. Standard sign on with username and password will still be available regardless of the state of the plugin.
28	+
29	+ = Who can use this plugin? =
30	+
31	+ Customers of the WP Starter and WP Essential plans can use this plugin to sign into their WordPress installations hosted with Endurance brands.
32	+
33	+ = How does this work? =
34	+
35	+ When a user signs into the vDeck Control Panel and requests to sign into WordPress, a nonce (number used once) and salt are generated and saved in the WordPress database as a secure hash. The user is redirected to their WordPress site with the nonce and salt. After the plugin verifies the credentials, the user is signed in.
36	+
37	+ = I'm having problems signing in. =
38	+
39	+ As a security precaution, each SSO attempt has a timeout of 20 seconds. If you are on a slow or spotty connection you may exceed this limit.
40	+
41	+ As an additional security measure, the plugin will refuse to authenticate users who have sent more than 5 failed attempts in three hours. You can still log in with a username and password normally or wait until this time expires.
42	+
43	+ == Screenshots ==
44	+
45	+ 1. To log in to your WordPress installation, find the Launch WordPress button...
46	+
47	+ 2. ...and you'll be logged in without needing another username and password.
48	+
49	+ == Changelog ==
50	+
51	+ 1.0 - Initial release.
52	+
53	+ == Upgrade notice ==
54	+
55	+ Initial release.