Tag Info

Hot answers tagged

10

Password is not unique all the time. According to worst password statistics, password is the most used Password of all time. I'm pretty sure some of your users too use that password. So multiple rows will contain the same hash. Hence its not possible. By the way, this is a weird question.


9

Its Not has hard as you think it is :) Add the password fields to your form : password: <input type="password" name="pass1" style="width:250px; margin-bottom:3px;"><br /> repeat password: <input type="password" name="pass2" style="width:250px; margin-bottom:3px;"><br /> then in your if($_POST){ replace this line: ...


8

First of all you need to find out which hashing algorithm has been used on the Joomla site to store the passwords. Joomla - different to Worpdress - ships with a variety of hashing algorithms. If you have found out how the hashes have been generated, you can port the hashing function over into wordpress and make use of a pluggable function called ...


8

One solution would be to create a custom Page template for Pages that you intend to password protect. Start by creating your custom Page template, perhaps named template-password-protected.php, and add the Template: file-docblock tag at the top, like so: <?php /** * Template: Password-Protected */ ?> Now, add your basic Page template markup: ...


6

Both the the_content() and the the_excerpt() template tags already account for password-protected posts, via the post_password_required() conditional. If you need to output content, or comments, etc. outside of the_content()/the_excerpt(), call the post_password_required() conditional directly. For example, if you don't want the comments template to be ...


6

The code he posted in that tutorial (very nice BTW) post's the form to the build-in "reset password" module which redirects to the login.php on error, but you can change that and build your own based on the original and add it to the template page, change: <form method="post" action="<?php echo site_url('wp-login.php?action=lostpassword', ...


6

You can hook onto save_post, wp_insert_post or wp_insert_post_data to modify the post object prior to it being inserted or saved. Using save_post or wp_insert_post the callback would need to declare two args and would receive the post object as the second incoming variable.. (and i'm showing you to cover the alternatives, TheDeadMedic's example would be ...


6

Actually you can bypass login mechanism of wordpress by login user automatically (after they succesfuly passed with credentials from another website for example) with this function: wp_set_auth_cookie($user_id); for example with this you do login admin (user with id = 1) wp_set_auth_cookie(1); //after this admin is logged in so you can create user in ...


6

TL;TR? Spoiler alert - hover over the next blockquote to expose it. DB Structure The password is part of the main $wpdb->posts table. It's saved in plain text (just to make that clear. Don't be afraid of that. It's not connected to any actual user login, so you don't have to be afraid that you are opening a security hole when someone finds it per ...


5

If wp_generate_password() was called with the third parameter $extra_special_chars = true a space might be part of the password: function wp_generate_password( $length = 12, $special_chars = true, $extra_special_chars = false ) { $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'; if ( $special_chars ) $chars .= ...


5

Figured it out! The new version of WordPress (3.4) changed the way the password protected pages worked. This should work for you now: <?php if ( post_password_required() ) { ?> <form method="post" action="/wp-login.php?action=postpass"> <p>This content is password protected. To view it please enter your password ...


5

So if you want to send that the reset password link and you have access to the code base you can use the following snippet and you can modify it further, actually that code is slightly modified version of wp-login.php /** * Handles sending password retrieval email to user. * * @uses $wpdb WordPress Database object * @param string $user_login User Login ...


5

Based on the latest details from Mario, this is meant as a back door and from his original question, the username and password would be encoded in the php file. Hard coded backdoors are big issues from a security perspective and should not be used. Passwords should be stored in encrypted databases so that they can be changed. The other concern I have with ...


5

Yes it's also possible for the password, by running a filter on lostpassword_url, which is basically the password equivalent of the login url.. Example Basically the same as before, just changed the function and hook names. add_filter( 'lostpassword_url', 'custom_lostpass_url' ); function custom_lostpass_url( $lostpassword_url ) { return ...


5

If you can get to phpMyAdmin (or something equivalent), open the DB and find the wp_users table. Select the appropriate user to edit and change the user_pass field to whatever. Set the function to MD5 and save. You should now be able to log in.


5

Yes there is. It's post_password_required: Whether post requires password and correct password has been provided.


5

Your example works correctly. You are checking if password hello matches hashed hello - which it naturally does. Hadn't thought it through. Your example causes following issue: You check if hello matches md5 of hello (instead of hash from user's profile). It does and then WP thinks this is correct, but outdated md5 hash - that must be updated. It ...


5

You can save this information on your wp-config.php file: define('FTP_HOST', 'ftp_host'); define('FTP_USER', 'ftp_username'); define('FTP_PASS', 'ftp_password'); More info (WordPress Codex)


5

WordPress does NOT use the MD5 hash for passwords anymore. It uses the PHPass library to generate secure password hashes. However, WordPress will support MD5 hashed passwords. On the first login of a user with such a password, it will detect that case and change the password entry to be the newer, more secure, PHPass version of the password. Therefore, the ...


5

Big Question. So, first, to keep the galleries separate, it would be good to give them their own custom post type. We'll be checking for this later... <?php add_action( 'init', 'wpse32840_register_post_type' ); function wpse32840_register_post_type() { register_post_type( 'client_gallery', array( 'label' ...


4

To answer your other question, about the two types of passwords stored in the database: Up until version 2.5, WordPress stored passwords encrypted with the MD5 hashing algorhythm. MD5 is nowadays considered to be poor security - with moderately-priced off-the-shelf GPUs, it takes less than a hour for a program to brute-force all possible combinations of ...


4

The easiest way to restore Super Admin privileges is to add a bit of code to your theme's functions.php file to add yourself back: include(ABSPATH . 'wp-admin/includes/ms.php'); $user = get_userdatabylogin('YOUR_USERNAME'); grant_super_admin($user->ID); Once your Super Admin privileges have been restored you can remove this code from your theme.


4

I was busy writing up a plugin for this without even checking of one already existed. So I did a little research and found out that it does indeed already exist and that the path I was going down was the right one. Well, there's no need to reinvent the wheel here, so here's the link to the existing plugin. ...


4

Try this (don't forget to replace icon URL): add_filter( 'display_post_states', 'password_protected_icon' ); function password_protected_icon( $post_states ) { $text = __('Password protected'); $pos = array_search( $text, $post_states); if( false !== $pos ) $post_states[$pos] = '<img src="http://i.stack.imgur.com/aIDa6.png" ...


4

The latest entered password is stored as a secure hash in a cookie named 'wp-postpass_' . COOKIEHASH. When the password form is called, that cookie has been validated already by WordPress. So you just have to check if that cookie exists: If it does and the password form is displayed, the password was wrong. add_filter( 'the_password_form', ...


4

When you set a post as password protected, the protection happen on get_the_content() function. There WordPress check for a post password cookie, and if not set, not valid or expired then show the password form. This password form is submitted to wp-login.php, there a cookie is setted according to the password wrote in the form, then the request is ...


3

Previous answer didn't worked for me (says that code is invalid, on wp login page), probably because answer is 1,5 yr old, and something is changed in WP code, so I have updated this code a bit (also from wp-login.php), here it is: function retrieve_password($user_login){ global $wpdb, $wp_hasher; $user_login = sanitize_text_field($username); ...


3

You could try hooking into template_include and showing the user a completely different page containing the login form (without changing the URL) if the post is password protected. Combine that WordPress' built in post password functionality and you have something really close to what you want (blocking an entire page). You could also use {{insert whatever ...


3

Interesting question :) Here is a very simple implementation. /** * Template Name: Pass-Prot * */ function only_password_protected($where) { remove_action('posts_where','only_password_protected'); return ' AND post_password != ""'; } add_action('posts_where','only_password_protected'); $protected = new WP_Query( array( 'post_type' => ...


3

This is a built-in feature of WordPress. Create a page like you normally would. Then look at the Publish box in the upper-right corner for where it says "Visibility: Public." Click "Public" and you'll see some other options - "Private" and "Password Protected." You want "Password Protected." Check the appropriate box and enter the password of your ...



Only top voted, non community-wiki answers of a minimum length are eligible