[Plugin: WordPress MU Domain Mapping] infinite loop, and HTTP header controls

We use domain mapper extensively and found a glitch when combined with caching.

It caches the script …
< $cript src='{$protocol}{$current_site->domain}{$current_site->path}?dm={$hash}&action=load&blogid={$current_blog->blog_id}&siteid={$current_blog->site_id}&t=" . mt_rand() . "&back=" . urlencode( $protocol . $current_blog->domain . $_SERVER[ 'REQUEST_URI' ] ) . "' type='text/javascript'></ $cript> //changed for HTML safety

… on pages and forces Admins through an infinite redirect loop.

We have 2 fixes for this.

Preferably, somewhere, log the dm={$hash} and t=mt_rand() combination temporarily so that dm+time -code is used only once and then ignored in future iterations preventing the loop. If dm=x & t=y gets generated on a page, the first person to use it is sent the redirect (log its use at that time). Then, all people who hit the cached page, will call that script and it will be found as a duplicate in the logs, and they will NOT be sent the redirect again.

As a temporary fix:
We are currently using cookies in a modified remote_login_js() :
————————–

$wpdb->query( $wpdb->prepare( "INSERT INTO {$wpdb->dmtablelogins} ( 'id', 'user_id', 'blog_id', 't' ) VALUES( %s, %d, %d, NOW() )", $key, $current_user->ID, $_GET[ 'blogid' ] ) );
$url = add_query_arg( array( 'action' => 'login', 'dm' => $hash, 'k' => $key, 't' => mt_rand() ), $_GET[ 'back' ] );

setcookie('dmredirect', 'recent', time()+5, '/'); //stop login redirects for 5 seconds//
header("Cache-Control: no-cache, must-revalidate", true);  //prevent caching this script.

echo "window.location = '$url'";
exit;

———————-

Then above that, in the begining of the function, we made a few more changes.
It is not proper code to just ‘exit’ php. A 204 SHOULD be returned indicating no content. This is also where I put my code looking for the cookie to prevent redirects:

if ( !is_user_logged_in() ) {
  header('HTTP/1.0 204 No Content', true, 204); //tell them nothing
  exit;
}
//if recently redirected, halt the process and discontinue
if($_COOKIE['dmredirect'] == 'recent'){
  header('HTTP/1.0 204 No Content', true, 204);
  exit;
}

So this corrects the empty pages being returned with a http status 200,
prevents an infinite loop from cached pages with a cookie
and uses Cache-Control headers to prevent caching of dynamically generated scripts.

Instead of the cookie solution, we would like to see a DB-logging of redirects on dm= and t= to prevent people getting the cached redirect.
That way they don’t receive the first redirect in order to set a cookie to stop it the 2nd time.

Peter

https://www.ads-software.com/extend/plugins/wordpress-mu-domain-mapping/