Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Very odd problem with wp_signon

Below I pass a users credentials to wp_check_password and it returns true proving the password is correct.... however when i try to signin it return wp_error with
"ERROR: The password you entered for the username XXXXXXX is incorrect."

Please, can anybody explain why this is? and how to fix?


$password = "vdouW#DswYMH"
$hashed = wp_hash_password($password);   //$P$Bydu8uFLe8CFXmtGjA71Tfv8Tyo7nH0

if (wp_check_password($password,$hashed,$user->data->ID)) {
    echo "Yes, password correct".
    $creds['user_login'] = $user->data->user_login;
    $creds['user_password'] = $password;
    $creds['remember'] = false;
    $user2 = wp_signon( $creds, true );

    if ( is_wp_error($user2) )
        echo $user2->get_error_message().' - '.$hashed;
    else
        echo 'Success<br/>';
}
share|improve this question
    
have you done a sanity check and verified that the pw you get back from wp_hash_password() actually matches the pw in the database? –  Milo Jul 11 '11 at 15:33
    
Yes, I've checked them multiple times... exactly the same... –  user608207 Jul 11 '11 at 19:39
add comment

2 Answers

What function are you adding your users with? I just ran into a fail in wp_update_user (3.1), resulting in wp_signon failing because password had been stored double-hashed. Using wp_insert_user seems to operate correctly.

share|improve this answer
add comment

Pretty sure wp_check_password() is not meant to be used the way you're using it.

From the looks of the documentation, and as far as I can tell by looking at the source, this function is only meant to compare the plaintext password you provide against the hash you provide--not to check whether a particular user's stored password matches the passed creds. (The user id param is misleading--it has to do with converting a user's existing password form one kind of hash to another when necessary, I believe. But I'm not 100% sure).

In any case, you don't need to do any of this checking manually. The wp_signon() function will itself will check the creds, and if they're correct it'll log the user in and pass back a valid user object. If the creds aren't right, it'll pass back an error object.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.