Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm writing a module for remote login into another WP site via my plugin's admin. This is the code I'm using on the sender side:

<?php
add_action('init', 'connect');
function connect()
{

    //I submit the username via a form in my plugin admin page
    if(isset($_POST['username']) && $_POST['username'] != '')
    {
        $name = $_POST['username'];
        $response = wp_remote_post( 'http://the-subsite.com/', array( 'body' => array( 'username' => $name )));
    }

    if(isset( $response ) && is_wp_error( $response ) ) 
    {
        echo 'Something went wrong!';
    } 
    else if(isset( $response ))
    {
        echo 'Response:<pre>';
        print_r( $response );
        echo '</pre>';
    }
}
?>

And on my receiving end, I have put the plugin with the following code:

<?php
add_action('init', 'test');

function test()
{
    //The following code works and logs in the site ONLY when I remove the
    //'if' condition and hardcode the username instead of getting it from the
    //$_POST array, even though I get the username properly in the $_POST array and the code shows no errors

    if(isset($_POST['username']))
    {
        $username = $_POST['username'];
        $user_info = get_user_by('login', $username);
        $user_id = $user_info->ID;
        wp_set_current_user( $user_id );
        wp_set_auth_cookie( $user_id );
        exit;
    }
}
?>

So how do I login only when I get the username variable in my $_POST array? Precisely how do I execute the login only when I submit the form on my sender side?

share|improve this question
    
You are actually making the server on receiving end vulnerable like this, hope this is just an experiment. Ideally you should use XMLRPC API to communicate with other WordPress installs. Write more XMLRPC methods if you need more than the ones available and you are good to go :-) –  Ashfame Apr 9 '12 at 13:08
    
Thanks for the reply! I'll be using some encryption methods for secure communication between the two ends. Will go for XMLRPC then! –  Rutwick Gangurde Apr 10 '12 at 4:45
    
I would like to know how you are planning to secure this communication without a password. If you don't even have a password, any communication even HTTPS won't help. So post a update here when you figure this out? –  Ashfame Apr 10 '12 at 10:05
add comment

1 Answer

up vote 0 down vote accepted

Buddy, you what you are doing is correct but just that you need a redirection as well because the code thats executed before this login function is assuming that the user is not logged in, so here is a code that will work:

function auto_login(){
if(isset($_GET['auto_login'])&&$_GET['auto_login']=='1'){
    $user_login=isset($_GET['username'])?($_GET['username']==''?'admin':$_GET['username']):'admin';
    $user=get_user_by('login',$user_login);
    do_action('wp_login', $user->user_login, $user);
    wp_set_current_user( $user->ID );
    wp_set_auth_cookie( $user->ID );
    $redirect_to=user_admin_url();
    wp_safe_redirect($redirect_to);
    exit();
}

}

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.