0

I am building sites where I secretly give authoring role capability to visitors by auto-logging them into a generic account; they never see the admin bar, and are prevented from seeing the dashboard (with Remove Dashboard Access plugin).

Everything works fine except I would like to have the site automatically log out after a short time frame, like an hour. I have been trying the approach here https://wordpress.stackexchange.com/a/51887/14945 This and others work by changing the auth_cookie_expiration for all users, not what I want (admins and editors need regular settings).

I call a function I use elsewhere to verify the current user is the generic account (login name = 'collector')

function trucollector_check_user( $allowed='collector' ) {
    // checks if the current logged in user is who we expect
    global $current_user;
    get_currentuserinfo();

    // return check of match
    return ( $current_user->user_login == $allowed );
}

and this is my cookie changing function

function trucollector_change_cookie_logout( $expiration, $user_id, $remember ) {
    return $remember ? $expiration : 3600;
}

What I am stuck on is where to call the add_filter where I can check for the correct user; I have tried putting in a function called on an action of after_setup_theme

add_action('after_setup_theme', 'trucollector_shorten_cookie');

function trucollector_shorten_cookie() {
        // change to short auto logout time
        if ( trucollector_check_user() ) {
            add_filter( 'auth_cookie_expiration', 'trucollector_change_cookie_logout', 99, 3 );
        }

}

It looks like when I inspect the cookies in my browser that there is a shorter one set, but it does not seem to be logging out my guest user.

Most likely my logic here is missing something....

2

One approach can be to log the time a user is logging in at by using:

function user_last_login($user_login, $user) {
   update_user_meta($user - > ID, 'last_login', time());
}
add_action('wp_login', 'user_last_login', 10, 2);

and then checking if the time is passed:

add_action('get_header', 'processOnPageLoad', 1 );
add_action('admin_init', 'processOnPageLoad', 1 );
function processOnPageLoad() {
if( is_user_logged_in() && condition_to_check_required_user ) {
      $last_login_time = get_the_author_meta('last_login');
        $allowed_time = 5 * 60; // This will be 5 minutes in seconds
        if (time() > ($last_login_time + $allowed_time)){
            wp_logout();
            wp_redirect( wp_login_url() );
        }
}
}

Please replace the required condition to check the current user, I haven't checked the code but this should do the trick.

This code will not work right after copy-paste you will need to specify the condition to check.

The above code will logout the user after 5 minutes of logging in.

0

What you are trying to do is not very secure. You have to remember that there is no such thing as logged-in session on the internet, and authentication has to be done with every http request being send. The authentication cookie, while not carrying the password itself in simple plain text, can be used whenever anyone wants to "login" to your site, even after your expiration time.

I haven't looked yet at the session management introduced at 4.1 but I fail to see how it can overcome that basic reality.

The only way to achieve what you want is to change the password for that user. What you are trying to do might work with non tech savvy people, but if this is something that it is important for your business then you need to be aware it is not a secure approach.

  • Thanks. I fully understand the wide holes. This is an experimental cooperative art / education site, not anything sensitive in terms of the contents. I am not giving away the password; it is hidden, and the login is done invisibly, and I can easily change it from one single edit. – cogdog Jan 28 '15 at 23:29
  • ok, now that we agree that there is no such thing as logout ;), is there a possibility your code automatically renews the cookie? – Mark Kaplun Jan 29 '15 at 4:45
  • I never touch the cookies in the code. My testing is setting the logout time to be 3 minutes. I log out of the site, delete cookies, and hit the link that autologs me in to the special account. I then do nothing for maybe 5 minutes. Click to another page. Still logged in. – cogdog Jan 29 '15 at 8:32
  • if you auto logged you must have resent cookies, that is what "login" is all about in the end – Mark Kaplun Jan 29 '15 at 9:05
  • I'm putting the add_filter in my auto login script, which is only called if not logged in. Not sure if it should go before or after wp_signon() which I gather resets cookie? – cogdog Jan 29 '15 at 18:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.