Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I am working on a wordpress site for a client who wants an internal 'intranet' for his employees. The basic needs are:

  1. Communicate things in-house
  2. House important company documents
  3. Provide quick access to resources to employees.

This info is sensitive and for employees only. They would like each employee to have a user name / password and only be able to view information and documents once they are logged in.

I saw these plugins, and a few like it, but they seems limited, and of course they're completely out-dated now:

I know I can password-protect individual posts / pages. Can I password protect an entire category of posts, or better yet a custom post-type? Basically, I need to group some pages / posts together under a login. The information is sensitive so it can't be available, for instance in the RSS feed. How can I do this?

  • Option 1 (less desirable): have an entire wordpress build behind a login wall
  • Option 2 (more desirable): have just the internal pages / posts behind the login wall

Bottom line: I'm interested in option 1 if it's WAY easier, but would prefer option 2. Currently, after some research, I'm only finding out of date plugins that help with this, and can't seem to find a reliable way to pull either one off. Thanks for your help!

share|improve this question

5 Answers 5

If you want to manually manage the authentication and wrap it into the WordPress authentication, then @Rezen has the right idea. I'd prefer to just use a specific Page Template or list of Page Templates to check for auth, though.

You can also look at Justin Tadlock's "Members" plugin, it has a lot of custom role management that you could leverage, probably.

share|improve this answer
    
+1 for the suggestion to use page templates. –  timshutes Aug 6 '13 at 14:04

It's possible to put the check on the corresponding archive pages & single pages

But the one thing you should definitely do along with all the other solutions you take is to use the the_posts filter. It filters out the posts that any WP_Query retrieves. You'll get an array of post objects. Check for the condition & unset the object if it is there. This one is meant for when if all other solutions get bypassed. This is the last resort if some unknown plugin retrieves the posts without you having any idea about it.

Another thing you should use is the pre_get_posts filter to check the query variables & change them as required

Another one is posts_where filter, use it to add another where clause to mysql query

This is not completely secure but it should cover most of the cases & even most of the external plugins.

If you use a custom post type, it becomes a lot easier. You may set custom capabilities for that post_type & then give those capabilities to only users of a particular role.

You can ask your client to manually set every post to private but you can be sure that they will forget it now & then. If security is important, it's better to not go for that.

share|improve this answer
    
+1 for thoughts on security –  timshutes Aug 6 '13 at 14:22

This is old - but here is how I solved this issue ultimately.

  1. Created a custom post type for Intranet Pages.
  2. Added a "force_login" function in functions.php
  3. Included the force login function at the top of all necessary page-template files.

You could customize this to allow only for certain users - for instance, using the "Members" plugin @jason mentioned.

The code:

In functions.php

/* Require Authentication for Intranet */

function my_force_login() {
global $post;

if (!is_user_logged_in()) {
    auth_redirect();
    }
}    

At the top of page-intranet.php and single-intranet-pages.php

<?php my_force_login(); ?>

AND... that's it. It's working.

Notes on security:

  • I don't know exactly why, but I don't think the security of this method is completely bulletproof.
  • It works for my situation, but do some more digging if you need bulletproof security.
  • See @Mridul's answer below for more information

If you have a simple method for this that is more secure, leave it below and I'll mark it as the answer.

share|improve this answer

You can set content visibility to private on specific pages and that would require visitors to have a WordPress login AND permissions levels to view the content. What I would maybe suggest is create a template-intranet.php for the "Intranet" page and add a custom menu for the pages that are part of the intranet so they can be listed on that page. You would still have to set all the pages status to Private.

A workaround to making all intranet pages Private would be in the functions.php you can write a conditional to check if the current page is a subpage of the "Intranet" page - if the page is a subpage of intranet then check if the user is logged in, and if they are not redirect them, if not continue on.

share|improve this answer

Filters:

add_filter('template_include', 'theme_check_user_permissions', 1, 1);
add_filter('logout_url','theme_logout_redirect');
if(!current_user_can('edit_users')) add_filter( 'wp_die_handler', create_function('',"return 'theme_wp_die_handler';"));

If user is not registered, then redirect to login page on site(guest.php, no dashboard)

function theme_check_user_permissions($template) 
{
    return (is_user_logged_in() ? $template : TEMPLATEPATH.'/guest.php');
}

After login redirect to home page

function theme_logout_redirect($url, $redirect = null)
{
    return $url.'&amp;redirect_to='.urlencode(get_bloginfo('url'));
}

Remove wp die page(redirect to home)

function theme_wp_die_handler()
{
    wp_redirect(get_bloginfo('url'),307);
    exit;
}
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.