Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Overview:
On my site I want to do a customer area. There is a form where the visitor enters a name (e.g. "event_xyz") and a password. Only some well informed circles (participants of the event xyz who want to download some files) will know the access data. By submitting, the visitor is redirected to a pp-redirect.php which should set the cookie to access the specific site the visitor wants to access - $_POST['name'] equals the post's slug.

I found this script to set that cookie and tried to solute my problem like this:

global $wp_hasher;
if ( empty( $wp_hasher ) ) {
    require_once( ABSPATH . 'wp-includes/class-phpass.php' );
    $wp_hasher = new PasswordHash(8, true);
}

setcookie( 'wp-postpass_' . COOKIEHASH, $wp_hasher->HashPassword( stripslashes( $_POST['pw'] ) ), 0, COOKIEPATH );

wp_safe_redirect( "http://www.domain.com/wordpress/".$_POST['name'] );
exit();

But this shows me the error that in this file and in wp-includes/pluggable.php the headers were already sent. I also don't know how the script, which is taken from the wp-login.php?action=postpass, knows which site I want to access. Any solutions?

share|improve this question
    
I assume that you have debugging enabled? That is how you are getting the errors? Do you have a live URL? Provide as much detail as you can, please. –  s_ha_dum Jul 1 '13 at 17:19

2 Answers 2

You will need to hook that code so that it runs before any data is sent to the browser.

function remote_login_wpse_104911() {
  global $wp_hasher;
  if ( empty( $wp_hasher ) ) {
    require_once( ABSPATH . 'wp-includes/class-phpass.php' );
    $wp_hasher = new PasswordHash(8, true);
  }

  setcookie( 'wp-postpass_' . COOKIEHASH, $wp_hasher->HashPassword( stripslashes( $_POST['pw'] ) ), 0, COOKIEPATH );

  wp_safe_redirect( "http://www.domain.com/wordpress/".$_POST['name'] );
}
add_action('template_include','remote_login_wpse_104911');

That is completely untested. I don't have all the information I'd need to test it if I want to. :) You will almost certainly have to modify that to work in the new context. But that is the idea.

share|improve this answer
    
I didn't know template_include, this looks like an good idea! But if I try this, every page/subpage/post on my site will be redirected to $_POST['name']. As the login site is redirected too, I am redirected to the root (/wordpress/), even if I recheck if there was a form submitted. But actually there is no website showing up all in the browser ("Too much redirects"). But I understand the main idea to run this function remote_login_wpse_104911() before the specific page is loaded and so the access could be provided. –  luke Jul 1 '13 at 16:08
    
Actually, I forget about template_include also. I just copied your code into the function. You will have to modify it to work in the new context, of course. –  s_ha_dum Jul 1 '13 at 16:11
    
I don't know where the error is. Even if I comment the redirect lines out, the page stays white. Another possibility could be the indirect way via wp-login.php but I only know that the password must be delivered as $_POST['post_password']. If I could transfer POST variables without users action, actually only via PHP, this would be the solution, right? So the visitor logs in, and my pp-redirect.php (or the function called by template_include) will redirect to wp-login delivering the password as a POST variable. –  luke Jul 1 '13 at 16:40
up vote 1 down vote accepted

Finally, I found the solution:

form.php

<form action="<?php echo bloginfo('template_directory'); ?>/pp-redirect.php" method="post">
Event: <input name="event" type="text" size="25" /><br />
Passwort: <input name="post_password" type="password" size="25" /><br />
<input name="submit" type="submit" value="Los" />
</form>

pp-redirect.php

<?php
/** Make sure that the WordPress bootstrap has run before continuing. */
require( dirname(__FILE__) . './../../../wp-load.php');
global $wp_hasher;
if ( empty( $wp_hasher ) ) {
    require_once( ABSPATH . 'wp-includes/class-phpass.php' );
    $wp_hasher = new PasswordHash(8, true);
}
if ( get_magic_quotes_gpc() )
    $_POST['post_password'] = stripslashes($_POST['post_password']);

// Expires when the browser shuts down
setcookie( 'wp-postpass_' . COOKIEHASH, $wp_hasher->HashPassword( stripslashes( $_POST['post_password'] ) ), 0, COOKIEPATH );

wp_safe_redirect( get_bloginfo('url') . "/" . $_POST['event'] );
?>

Greets!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.