0

I've found this advice for restricting the access to a whole WP site via adding a function to the init hook that holds a whitelist of IP adresses. I tried to rewrite that to the condition that only pages of a specific template are restricted. This would help me using our corporate WP blog for intranet purposes (we're still using a deprecated TYPO3 site which is a pain in the a** to manage). However, my code doesn't seem to restrict anyone. Can you help me with that? Here's my current code (inside functions.php):

function intranet() {
    $ip = $_SERVER['REMOTE_ADDR'];
    $whitelist = array('172.18.131.26','[plenty of others within the local network...]');
    if(!in_array($ip, $whitelist) && is_page_template('page_intra.php')){
        header('HTTP/1.1 401 Unauthorized');
    }
}
add_action('init', 'intranet');

The file page-intra.php is simply a copy of the generic page.php if this helps any.

3
  • is_page_template doesn't work until after the main query is run, init is too early. – Milo Mar 3 '16 at 16:34
  • Okay, now I'm at the point where I tried other ones from the execution order but none of them seemed to work… – Circuit Circus Mar 3 '16 at 21:02
  • 1
    Could you simply put the code that's within the function into the custom page template itself? (I'd probably define the whitelist in a function inside of /mu-plugins/.) – Jeff Cohan Mar 4 '16 at 15:15
0

Now I have it working! In the meanwhile Jeff Cohan also gave the right advice on how to do it (see his comment on the question). Here's my full code, working the way he suggested:

function getUserIP() {
    $client  = @$_SERVER['HTTP_CLIENT_IP'];
    $forward = @$_SERVER['HTTP_X_FORWARDED_FOR'];
    $remote  = $_SERVER['REMOTE_ADDR'];

    if      (filter_var($client, FILTER_VALIDATE_IP))   {$ip=$client;}
    elseif  (filter_var($forward, FILTER_VALIDATE_IP))  {$ip=$forward;}
    else    {$ip = $remote;}
    return $ip;
} $ip=getUserIP();
$whitelist = array('172.18.131.26','172.18.131.254');
if(!in_array($ip, $whitelist))    {
    // Here comes the markup for some Error Message on the page if requested from outside
    ?><!doctype html><html><head><meta charset="utf-8"><meta name="robots" content="noindex, nofollow" /><title>Access denied</title></head><body><div id="wrapper"><h1>401: Access Denied</h1><p>You're not allowed to view the requested page.</p></div></body></html><?php
} else {
    // Buisness as usual, the generic wp page loop 
    get_header(); ?>

            <div id="container">
                <div id="content" role="main"></div><!-- #content -->
            </div><!-- #container -->

    <?php
    get_sidebar();
    get_footer();
}
?>

That code is all inside the page-intra.php now, not making use of functions.php or anything. You now may simply choose the Template when adding a new page and you're done.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.