0

I need to call a PHP script external to WP and I would like to take advantage of the credentials of WP so that only logged users can access this script. I have tried to use this code embedded in my external PHP script but it would not work (where XXX is the domain name):

    require('/var/www/vhosts/xxx.xxx.xxx/httpdocs/wordpress/wp-blog-header.php');

if ( !is_user_logged_in () ) {
   //the script exits if the user is not logged in
   showAccessDenied($day, $month, $year, $area, isset($room) ? $room : "");
   exit;
} 

Do you have any clue? Many thanks in advance!!

0

I would do this the other way around:

if ( !is_user_logged_in () ) {
  //the script exits if the user is not logged in
  require('/path/to/your/script.php');
  showAccessDenied($day, $month, $year, $area, isset($room) ? $room : "");
}

You can work that into a page in a number of ways. I don't have enough detail to provide an example that fits your needs.

  • Thank you s_ha_dum. I was not clear enough in my question. Indeed, what I need is to test from the external script whether my user is logged in WP. If he is, the user is allowed to do something otherwise he is directed to a denied access page. So I need to perform the test from the external script. – user1401141 Jun 16 '15 at 4:24
  • No one? Must not be so complicated, or? – user1401141 Jun 18 '15 at 4:47
  • I know that what you think you need is to test from the external script... I am not convinced that that is true. – s_ha_dum Jun 18 '15 at 5:49
  • Let me explain then: I display a planning manager with an external PHP script. I want that only registered users to be able to add an event on the calendar. Of course, the planning is displayed on a WP page that is accessible only to registered users. But, a smart guy could have a direct access to the PHP script. So, to prevent this situation, I want to check that a WP user is trying to edit the planning. Therefore, I think that the only solution is that the PHP script checks whether the user is a registered WP user. Or?... – user1401141 Jun 18 '15 at 16:18
  • OR? -- Or have your script check for a WordPress global like ABSPATH and die if it isn't defined. Or have your script accept requests only from your IP. Or parse requests only if a particular hash is included. Or have your script not parse HTTP requests at all. Or some combination of the above, probably. You seen to be thinking of only a very subset of approaches. – s_ha_dum Jun 18 '15 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.