0

I need to call a PHP script external to WP and I would like to take advantage of the credentials of WP so that only logged users can access this script. I have tried to use this code embedded in my external PHP script but it would not work (where XXX is the domain name): 

    require('/var/www/vhosts/xxx.xxx.xxx/httpdocs/wordpress/wp-blog-header.php');

if ( !is_user_logged_in () ) {
   //the script exits if the user is not logged in
   showAccessDenied($day, $month, $year, $area, isset($room) ? $room : "");
   exit;
}

Do you have any clue? Many thanks in advance!!

Improve this question

1 Answer 1

Reset to default
0

I would do this the other way around:

if ( !is_user_logged_in () ) {
  //the script exits if the user is not logged in
  require('/path/to/your/script.php');
  showAccessDenied($day, $month, $year, $area, isset($room) ? $room : "");
}

You can work that into a page in a number of ways. I don't have enough detail to provide an example that fits your needs.

Improve this answer
8
  • Thank you s_ha_dum. I was not clear enough in my question. Indeed, what I need is to test from the external script whether my user is logged in WP. If he is, the user is allowed to do something otherwise he is directed to a denied access page. So I need to perform the test from the external script.
    – user1401141
    Commented Jun 16, 2015 at 4:24
  • No one? Must not be so complicated, or?
    – user1401141
    Commented Jun 18, 2015 at 4:47
  • I know that what you think you need is to test from the external script... I am not convinced that that is true.
    – s_ha_dum
    Commented Jun 18, 2015 at 5:49
  • Let me explain then: I display a planning manager with an external PHP script. I want that only registered users to be able to add an event on the calendar. Of course, the planning is displayed on a WP page that is accessible only to registered users. But, a smart guy could have a direct access to the PHP script. So, to prevent this situation, I want to check that a WP user is trying to edit the planning. Therefore, I think that the only solution is that the PHP script checks whether the user is a registered WP user. Or?...
    – user1401141
    Commented Jun 18, 2015 at 16:18
  • OR? -- Or have your script check for a WordPress global like ABSPATH and die if it isn't defined. Or have your script accept requests only from your IP. Or parse requests only if a particular hash is included. Or have your script not parse HTTP requests at all. Or some combination of the above, probably. You seen to be thinking of only a very subset of approaches.
    – s_ha_dum
    Commented Jun 18, 2015 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.