Password Protected Page + Showing Different Page If Not Authenticated/Authorized

Question

I have a few pages of custom posts that I would like to password protect via the following business rules:

• I can create a number of passwords to access the page
• An expiration date can be set for each password
• Logged in admins are automatically authenticated/authorized to see the page
• Display different content depending if the user viewing the page is authenticate/authorized (e.g. if not logged in, display the page with modified content + password field; if logged in, display all the content)

It would also be good if I could set these password to apply to multiple pages at once. Is there a way to do this in WP natively?

Answer 1

As ialocin mentioned some requirements will require extra customizations.

I can create a number of passwords to access the page

You would create user accounts. Passwords don't exist without users.

An expiration date can be set for each password

This isn't implemented in wordpress and requires the most work. You could probably store a date in usermeta and check it upon each login and update when password is reset. Take a look at these functions:

https://codex.wordpress.org/Function_Reference/update_user_meta https://codex.wordpress.org/Function_Reference/get_user_meta

Logged in admins are automatically authenticated/authorized to see the page

There are several ways to accomplish this. You definitely want to create a new Role and you could use a Page Template for the given set of pages that role would have access to.

I would recommend not giving administrative privileges since those allow people to make changes to the site itself (unless that is your intention) and instead assign the custom Role.

Sample code to create a role. Define a constant for the role name so you can then reference it from the tamplate. This way you can also control specific permissions relating to other access:

    define('SOME_ROLE', 'somerole');
    define('ADMINISTRATOR_ROLE', 'administrator');

    add_role(SOME_ROLE, __( 'Some Role', 'textdomain' ), array(
        'read'                   => true,
        'edit_posts'             => false,
        'delete_posts'           => false
    ) );

You can use this function to check if a user has the given role:

public static function current_user_has_role($role) {

    $user = wp_get_current_user();
    if(in_array($role, (array) $user->roles )) {
        return true;
    }        
    return false;

}

You would add following code to the top of your template php. This will check if the user has the role or any other role with administrative privileges. Again there are probably other ways to accomplish this using filters etc. but this will work.

// Check access
if(  !is_user_logged_in() || 
     !(current_user_has_role(SOME_ROLE) || 
       current_user_has_role(ADMINISTRATOR_ROLE))) {
    wp_redirect(wp_login_url());
    exit;
}

Display different content depending if the user viewing the page is authenticate/authorized (e.g. if not logged in, display the page with modified content + password field; if logged in, display all the content)

You could change the wp_redirect call above to a different url or add additional logic.