Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't had any luck finding a plugin to accomplish this. Does anybody know of one I can use to get this functionality?

Related: Login security question - Does WP show me if I'm logged in from multiple locations?

share|improve this question
    
This one at least binds the cookies to the IP. Probably it is of use: w-shadow.com/blog/2008/07/12/safer-cookies-plugin-for-wordpress –  hakre Nov 18 '10 at 21:21
    
Hm - it's close, but it does not disallow sessions for the same user on multiple IPs. I'm logged in on my desktop and iPhone on 3G right now without issue. –  Gavin Nov 19 '10 at 15:41
    
Well I was certain, that it won't solve your issue, but that it is something in the direction. I've searched for more, but didn't found anything. Wait, this one stores (at least failed) IPs of logins into the database. This can be of use as well to write a plugin that does what you wants: wordpress.org/extend/plugins/login-lockdown –  hakre Nov 19 '10 at 20:10
    
I have a question back: Let's say your site has the user Gavin with the IP-A. Should no other user including Gavin be able to login from another ip, or should only a "second Gavin" not be able to login from another ip then IP-A? –  hakre Nov 19 '10 at 20:18
    
Only other 'Gavin' instances should not be able to log in. It wouldn't reject access though, but rather change the 'active IP' and log the other session out. –  Gavin Nov 22 '10 at 18:31
add comment

2 Answers 2

up vote 4 down vote accepted

As already suggested in a comment above of mine, technically a (cookie based) session is limited to one IP at a time by using the Safer Cookies (Wordpress Plugin).

This does not prevent to allow another login with the same username and password because it is a feature of wordpress to allow you to login multiple times with your credentials and therefore with multiple IPs.

What you would like to achieve is to prevent multiple logins at all then. According to Otto, this is not trivial. Stacy writes, that the Wishlist Member (Wordpress Plugin) has such a functionality built in: IP-Login Protection. So probably that plugin or part thereof is a solution to your issue. IANAL, but that plugin is violating the GPL license as it restricts you to make use of your wordpress derivate. I would not use it.

But probably there is another plugin out there available, or it's quite easy to extend Login LockDown (Wordpress Plugin) to bind the whole session to the last valid IP recorded.

share|improve this answer
add comment

User can login only from one computer at a time. If user inactive 30 minutes, he can login from another computer. Try in different browsers. You must make 2 steps:

  1. Create 2 Columns (uni_hash, session_time) in table - wp_users, in you database.
  "ALTER TABLE  `wp_users` ADD COLUMN `uni_hash` VARCHAR( 80 ) NOT NULL";
  "ALTER TABLE  `wp_users` ADD COLUMN `session_time` int(11) DEFAULT NULL";

2./ Paste this code in function.php.

<?php
function myStartSession() {
    if(!session_id()) {
        session_start();}
}

function myEndSession() {
    session_unset();
    session_destroy(); 
}

if( !function_exists('single_user_login_uid_create')){
    function single_user_login_uid_create($ID){
            global $wpdb;
            $get_hash = $wpdb->get_results("SELECT uni_hash FROM `wp_users` WHERE user_login='".$ID."'");           
            if(isset($_COOKIE["user_uni_uid".$ID.""])){
                     $user_uni_uid = $_COOKIE["user_uni_uid".$ID.""];                    
                     if($get_hash[0]->uni_hash == ''){ $hash_result = $_COOKIE["user_uni_uid".$ID.""];}
                        else{$hash_result = $get_hash[0]->uni_hash; }   
                }else{
                     $user_uni_uid = 'hash';
                     if($get_hash[0]->uni_hash != ''){ $hash_result = $get_hash[0]->uni_hash;}
                        else{$hash_result = 'hash'; }               
                     }

                     $check_time = $wpdb->get_results("SELECT session_time FROM `wp_users` WHERE user_login='".$ID."'");            
                     if(!is_null($check_time)){$time_result = $check_time[0]->session_time;}
                     else{$time_result = time()-2000;}  

            if( (time() - $time_result < 1800)&&($hash_result != $user_uni_uid) ){
                     myEndSession();
                     wp_clearcookie();
                     wp_die('<h1>User is login! </h1>', '', array( 'back_link' => true ));                   
                     do_action('wp_logout');
                     nocache_headers();
                     $redirect_to = home_url();
                     wp_redirect($redirect_to);                  
                     exit();            
                }else{                                   
                     $_SESSION["LAST_ACTIVITY"] = time();
                     $new_time = $_SESSION["LAST_ACTIVITY"];
                     $randUID = md5(microtime().$_SERVER['REMOTE_ADD'] );
                     $sql = "UPDATE  `wp_users` set `uni_hash`='".$randUID."', `session_time`='".$new_time."' WHERE user_login='".$ID."'";
                     $wpdb->get_results($sql);
                     setcookie("user_uni_uid", $randUID, 9999999999);
                }       
            }
        } 

if( !function_exists('single_user_login_uid_check')){
    function single_user_login_uid_check(){
        global $wpdb;       
        $ID = wp_get_current_user();
        $logout_url = wp_logout_url(home_url());
        $user_uni_uid = $_COOKIE["user_uni_uid".$ID->user_login.""];
        $sql = "SELECT  uni_hash FROM  `wp_users` WHERE uni_hash='".$user_uni_uid."'";      
        $getinfo = $wpdb->get_results($sql); 
        $check_time = $wpdb->get_results("SELECT session_time FROM `wp_users` WHERE user_login='".$ID->user_login."'");         
        if(!is_null($check_time)){$time_result = $check_time[0]->session_time;}
        else{$time_result = time()-2000;}       

        if(($getinfo[0]->uni_hash != $user_uni_uid)&&(time() - $time_result < 1800)&&(is_user_logged_in()) ){
            wp_clearcookie();
            myEndSession();
            do_action('wp_logout');
            nocache_headers();
            $redirect_to = home_url();
            wp_redirect($redirect_to);
            exit();
        }else{
            myStartSession();
            if(!isset($_SESSION["LAST_ACTIVITY"])){$_SESSION["LAST_ACTIVITY"] = time(); }           
            elseif (time() - $_SESSION["LAST_ACTIVITY"] > 120) {
               $_SESSION["LAST_ACTIVITY"] = time();
            }              
               $new_time = $_SESSION["LAST_ACTIVITY"];
               $sql = "UPDATE  `wp_users` set `session_time`='".$new_time."' WHERE user_login='".$ID->user_login."'";
               $wpdb->get_results($sql);            
        }       
    }
}
add_action('wp_login', 'myStartSession', 1);
add_action('wp_login','single_user_login_uid_create');
add_action('wp_logout', 'myEndSession');
add_action('init','single_user_login_uid_check');
?>
share|improve this answer
1  
Why? Please add an explanation. –  toscho Jan 22 at 4:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.