Add check for GET and POST globals for state validation

[joshcanhelp]

Changes

Add checking for state in other PHP globals in case $_REQUEST is not set.

Testing

• This change adds unit test coverage
• This change has been tested on WP 5.2.2

Checklist

• All existing and new tests complete without errors
• All code quality tools/guidelines in the Contribution guide have been run/followed
• All active GitHub CI checks have passed

[damieng]

Is this function only used in the WP_Auth0_LoginManager above?

I'm wondering if now accepting values from GET or POST as well as the previous objects opens up any kind of exploits. i.e. Perhaps we were validating some parameter we got posted back from auth but now the user could pre-inject a value on the URL so when we get redirected back we take the value from there rather than from the POST...

I think this function is a bit dangerous.

[joshcanhelp]

Is this function only used in the WP_Auth0_LoginManager above?

Yes, protected.

I totally understand your concerns here and thought about implications. It's used to:

• Get an auth0 parameter, which just triggers callback processing
• Checks for a state param, which is validated one time against a stored value
• Gets a code parameter which is exchanged immediately for tokens

The existing checks can only be internally set in WordPress, the ones I'm adding would just roll up into those if they are present (if everything goes according to plan) so no additional risk added here.

I'll address this in the upcoming, I agree that we should be looking for these values only where we expect them.