Login: SSO: Allow for the 2FA revalidate_2fa to be presented on other…

… origins.

See WordPress/wporg-two-factor#147.


git-svn-id: https://meta.svn.wordpress.org/sites/trunk@12578 74240141-8908-4e6f-9713-ba540dce6ec7

common/includes/wporg-sso/wp-plugin.php

@@ -285,6 +285,11 @@ public function redirect_all_login_or_signup_to_sso() {
 						return;
 					}
 
+					// Don't redirect the 2fa 'revalidate_2fa' handler to login.wordpress.org when presented on WordPress.org
+					if ( isset( $_REQUEST['action'] ) && 'revalidate_2fa' == $_REQUEST['action'] ) {
+						return;
+					}
+
 					// If on a WP login screen...
 					$redirect_to_sso_login = $this->sso_login_url;
 
@@ -420,6 +425,11 @@ public function login_post_url( $url, $path, $scheme ) {
 				return $url;
 			}
 
+			// Don't alter the revalidate 2fa form.
+			if ( str_contains( $url, 'wp-login.php?action=revalidate_2fa' ) ) {
+				return $url;
+			}
+
 			return $this->sso_host_url . '/wp-login.php';
 		}