0

I have several (client) sites that use security plugins that rewrite the standard wp-login.php access to something different, i.e. /myprivatelogin. (And yes, I know the issues about "obscurity is not security"; but this is not a security question).

Problem is that this login URL change breaks the functionality of using password protection for pages and posts, because WP redirects the password form on a passworded page/post to wp-login.php to verify the password before redirecting back to the page/post, and when wp-login.php doesn't exist, it breaks. The security plugins don't account for redirects to wp-login.php solely for passworded pages/posts; all URLs are redirected to i.e. myprivatelogin. The plugin devs don't appear to be interested in supporting passworded pages/posts.

What I'm trying to do is pretty hacky, but I'm thinking there is a way to get this to work. I want to redirect the submit form on passworded pages to a copy of the relevant code fromwp-login.php in my own file in the theme directory, have the password verified there and then be redirected back to the page/post.

The file wp-login.php handles all login work, and specifically for passworded pages/posts, uses the file wp-includes/class-phpass.php to decrypt and check the password before redirecting back to the page/post. See https://github.com/WordPress/WordPress/blob/master/wp-login.php

I have the first few steps working: I determine if a page/post has a password set by checking post_passwordon single.php and page.php, and if so, I load a jQuery function that rewrites the "post" URL of the form to my new login.php file in the theme directory, i.e.

<form
action="http://example.com/wp-content/themes/twentyfifteen/login.php"
class="post-password-form" method="post">

The form does submit to login.php, but that's where things break. I get a white screen and no errors are logged in debug. The URL stays at http://example.com/wp-content/themes/twentyfifteen/login.php with no redirect back to the page/post.

I assume the errors have to do with the functions wp_safe_redirect and wp_get_referer. Is this a "headers already sent" issue? Or the lack of an included core WP file?

This is my login.php and where the password entry form directs to on submit:

require_once('http://example.com/wp-includes/class-phpass.php');

if ( array_key_exists( 'post_password', $_POST ) ) {
        wp_safe_redirect( wp_get_referer() );
}

    $hasher = new PasswordHash( 8, true );

    /**
     * Filters the life span of the post password cookie.
     *
     */

    $expire = apply_filters( 'post_password_expires', time() + 1 * DAY_IN_SECONDS );
    $referer = wp_get_referer();
    if ( $referer ) {
        $secure = ( 'https' === parse_url( $referer, PHP_URL_SCHEME ) );
    } else {
        $secure = false;
    }
    setcookie( 'wp-postpass_' . COOKIEHASH, $hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ), $expire, COOKIEPATH, COOKIE_DOMAIN, $secure );


    wp_safe_redirect( wp_get_referer() );

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.