Support WordPress 4 login cookie.

DependencyInjection/Configuration.php

@@ -22,6 +22,7 @@ public function getConfigTreeBuilder()
 
         $rootNode->children()
             ->scalarNode('site_url')->defaultValue(null)->end()
+            ->scalarNode('version')->defaultValue('3')->end()
             ->scalarNode('logged_in_key')->defaultValue(null)->end()
             ->scalarNode('logged_in_salt')->defaultValue(null)->end()
             ->scalarNode('cookie_path')->defaultValue('/')->end()

Resources/config/services.yml

@@ -34,6 +34,7 @@ services:
             - %kayue_wordpress.cookie_domain%
             - %kayue_wordpress.logged_in_key%
             - %kayue_wordpress.logged_in_salt%
+            - %kayue_wordpress.version%
 
     kayue_wordpress.manager.authentication_cookie:
         class: %kayue_wordpress.manager.authentication_cookie.class%

Security/Http/WordpressCookieService.php

@@ -139,10 +139,26 @@ protected function processAutoLoginCookie($cookie)
      */
     public function loginSuccess(Request $request, Response $response, TokenInterface $token)
     {
-        if (false === $request->cookies->has($this->cookieManager->getLoggedInCookieName())) {
-            $response->headers->setCookie(
-                $this->cookieManager->createLoggedInCookie($token->getUser(), $this->options['lifetime'])
-            );
+        if ($this->configuration->getVersion() === 4) {
+            /**
+             * @see https://github.com/WordPress/WordPress/blob/4.0/wp-includes/pluggable.php#L879-L883
+             */
+            // TODO: Create session token
+
+            $user       = $token->getUser();
+            $username   = $user->getUsername();
+            $password   = $user->getPassword();
+            $expiration = time() + $this->options['lifetime'];
+            $hmac       = $this->generateHmac($username, $expiration, $password);
+
+            $sessionToken = $this->sessionTokenManager->create($expiration);
+            $encodedCookie = $this->encodeCookie(array($username, $expiration, $sessionToken, $hmac));
+        } else {
+            if (false === $request->cookies->has($this->cookieManager->getLoggedInCookieName())) {
+                $response->headers->setCookie(
+                    $this->cookieManager->createLoggedInCookie($token->getUser(), $this->options['lifetime'])
+                );
+            }
         }
     }
 

Wordpress/ConfigurationManager.php

@@ -9,14 +9,23 @@ class ConfigurationManager
     protected $cookieDomain;
     protected $loggedInKey;
     protected $loggedInSalt;
-
-    public function __construct($siteUrl, $cookiePath = '/', $cookieDomain = null, $loggedInKey, $loggedInSalt)
+    protected $version;
+
+    public function __construct(
+        $siteUrl,
+        $cookiePath = '/',
+        $cookieDomain = null,
+        $loggedInKey,
+        $loggedInSalt,
+        $version = 3
+    )
     {
         $this->siteUrl = $siteUrl;
         $this->cookiePath = $cookiePath;
         $this->cookieDomain = $cookieDomain;
         $this->loggedInKey = $loggedInKey;
         $this->loggedInSalt = $loggedInSalt;
+        $this->version = $version;
     }
 
     public function getCookieDomain()
@@ -43,4 +52,9 @@ public function getSiteUrl()
     {
         return $this->siteUrl;
     }
+
+    public function getVersion()
+    {
+        return $this->version;
+    }
 }

Wordpress/SessionTokenManager.php

@@ -0,0 +1,82 @@
+<?php
+
+namespace Kayue\WordpressBundle\Wordpress;
+
+/**
+ * @see https://developer.wordpress.org/reference/classes/wp_session_tokens/
+ */
+class SessionTokenManager
+{
+    /**
+     * Generate a session token and attach session information to it.
+     */
+    public function create($expiration)
+    {
+        $session = ['expiration' => $expiration];
+        $token = $this->generatePassword(43, false, false);
+
+        $this->update($token, $session);
+
+        return $token;
+    }
+
+    /**
+     * Update a session token.
+     */
+    public function update($token, $session)
+    {
+        $verifier = $this->hashToken($token);
+        $this->updateSession($verifier, $session);
+    }
+
+    protected function updateSession($verifier, $session = null)
+    {
+        // TODO: Get user meta "session_tokens"
+        // $sessions = $this->get_sessions();
+
+        if ($session) {
+            $sessions[$verifier] = $session;
+        } else {
+            unset($sessions[$verifier]);
+        }
+
+        $this->updateSessions($sessions);
+    }
+
+    protected function updateSessions($sessions)
+    {
+        // Return all 'expiration' from sessions
+        $sessions = array_column($sessions, 'expiration');
+
+        if ($sessions) {
+            update_user_meta($this->user_id, 'session_tokens', $sessions);
+        } else {
+            delete_user_meta($this->user_id, 'session_tokens');
+        }
+    }
+
+    private function hashToken($token) {
+        // If ext/hash is not present, use sha1() instead.
+        if (function_exists('hash')) {
+            return hash('sha256', $token);
+        } else {
+            return sha1($token);
+        }
+    }
+
+    private function generatePassword($length = 12, $special_chars = true, $extra_special_chars = false)
+    {
+        $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
+
+        if ($special_chars) $chars .= '!@#$%^&*()';
+        if ($extra_special_chars) $chars .= '-_ []{}<>~`+=,.;:/?|';
+
+        $password = '';
+
+        for ( $i = 0; $i < $length; $i++ ) {
+            $password .= substr($chars, wp_rand(0, strlen($chars) - 1), 1);
+        }
+
+        return $password;
+    }
+}