Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

In a WP-based site I have a custom form which I need to hide from the general public and give access to only a select few who would then get a password from me, enter it and access the form and submit it. On form submission, I redirect them to another page. I have employed this bit of code below in my functions.php, which logs them out of the password-protected page, once redirected:

add_action( 'wp', 'post_pw_sess_expire' );
    function post_pw_sess_expire() {
    if ( isset( $_COOKIE['wp-postpass_' . COOKIEHASH] ) )
    // Setting a time of 0 in setcookie() forces the cookie to expire with the session
    setcookie('wp-postpass_' . COOKIEHASH, '', 0, COOKIEPATH);
}

Now the twist: once any of these select few are logged out of the password-protected page, I need the password to become invalid. Not necessarily, but sort of like a one-time password. A solution would be great, or please give me some pointers or alternatives if it's not possible.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

After submitting the form and before redirecting to new page, reset the current user's password.

A simple wp_update_user(array('ID' => $userid, 'user_pass' => 'YourNewPaSSword')); will do everything for you.

share|improve this answer

I did this small test and it works, but I have no idea if it's technically correct:

add_action( 'wp', 'post_pw_sess_expire' );

function post_pw_sess_expire() 
{
    if ( isset( $_COOKIE['wp-postpass_' . COOKIEHASH] ) )
    {
        // Setting a time of 0 in setcookie() forces the cookie to expire with the session
        setcookie('wp-postpass_' . COOKIEHASH, '', 0, COOKIEPATH);
        add_action( 'wp_footer', 'change_pw_wpse_119986' );
    }
}

function change_pw_wpse_119986()
{
    global $post;
    if( $post->post_password == md5('something') )
        return;
    $post->post_password = md5('something');
    wp_update_post( $post );
    remove_action( 'wp_footer', 'change_pw_wpse_119986' );
}

But there's a bigger problem: we have one password per page, not one password per person. Once the first one enters the pass, the next ones won't be able to use it. You'll need to build your own solution setting different passwords and unsetting each one as soon as the person uses it.

share|improve this answer
    
Does not work on my install. I have the code pasted on my functions.php. Here is what I did. I have set a password eg. 2013 for the concerned page. I go to the page as a non-logged-in user, enter pass, access form, submit form. I am redirected to other page. Now I go to the page, I see I am logged out so (so far so good), I enter the same pass again and I get access again. This is not supposed to happen right, What am I missing ? –  gurung Oct 25 '13 at 7:48
    
additionally, i am getting this warning - Attempt to assign property of non-object in /home2/xxx/public_html/wp-content/themes/xxx/custom-functions.php on line 19. This is what is on line 19 - $post->post_password = md5('something'); –  gurung Oct 25 '13 at 8:01
    
one more warning beneath the first one is - Warning: array_merge() [function.array-merge]: Argument #2 is not an array in /home2/xxx/public_html/wp-includes/post.php on line 3006. This is what is on line 3006- $postarr = array_merge($post, $postarr); Both these warnings appear when I logged into the page after having put the password, otherwise it is not visible. Both these warning appears in the footer area. –  gurung Oct 25 '13 at 8:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.