1

I want to create a custom plugin to add a login with url functionality to my wordpress sites.

For example, I want to create a link as follows:

www.mysite.com/wp-admin?username=xxxx&pass=xxxxx

For implementing this i found a code which is to be added to funtions.php file of any theme or plugin. The code is:

<?php
if( isset($_GET['username']) and $_GET['pass'] ) {
    $user = get_user_by('login', $_GET['username']);

    if ( $user && wp_check_password( $_GET['pass'], $user->data->user_pass, $user->ID) ) {
        wp_set_current_user($user->ID, $user->user_login);
        wp_set_auth_cookie($user->ID);
        do_action('wp_login', $user->user_login);

        wp_redirect( admin_url() );
        exit;
    }

    wp_redirect( home_url() );
    exit;
}
?>

But instead of hampering the files of any theme or plugin i want to create a custom plugin to add this functionality.

Also by doing this i will be able to just simply install that plugin to all of my sites to add that functionality without hampering the code of any other plugin or theme.

I tried to create a plugin named TechyParas to add this. But sadly it hasn't worked. The code i added to my plugin was:

<?php
/*
* Plugin Name: TechyParas
* Description: This plugin will display a fixed link on the footer of your website.
* Version: 1.0.0
* Author: TechyParas
* Author URI: https://techyparas.com
* License: GPL2
*/
function techyparas_log(){
if( isset($_GET['username']) and $_GET['pass'] ) {
    $user = get_user_by('login', $_GET['username']);

    if ( $user && wp_check_password( $_GET['pass'], $user->data->user_pass, $user->ID) ) {
        wp_set_current_user($user->ID, $user->user_login);
        wp_set_auth_cookie($user->ID);
        do_action('wp_login', $user->user_login);

        wp_redirect( admin_url() );
        exit;
    }

    wp_redirect( home_url() );
    exit;
}}
add_filter('loginout', 'techyparas_log'); 
?>

Please help me with this.

2 Answers 2

0

I have used this same code and it does work. However, you need to use an action hook instead of a filter, as follows:

Replace add_filter('loginout', 'techyparas_log'); with:

add_action('init', 'techyparas_log');

Also, I set this up as a must-use plugin, but I don't see why it wouldn't work as a regular plugin.

0

Please review the code and do not use it until you are sure you understand it. It is also your responsibility to detect and fix security vulnerabilities. I tried to implement a build that works quickly.

<?php
/*
* Plugin Name: TechyParas
* Description: This plugin will display a fixed link on the footer of your website.
* Version: 1.0.0
* Author: TechyParas
* Author URI: https://techyparas.com
* License: GPL2
*/


function techy_add_custom_login() {
    $redirect_url = !empty($_GET['redirect_to']) ? parse_url($_GET['redirect_to']) : '';

    if(!empty($redirect_url)) {
        $userinfo = $redirect_url['query'] ?? '';

        if(!empty($userinfo)) {
            parse_str($userinfo, $info);
            if( !empty($info['username']) && !empty($info['pass']) ) {

                $creds = array(
                    'user_login'    => trim( wp_unslash($info['username']) ),
                    'user_password' => $info['pass'],
                    'remember'      => false,
                );
                $user = wp_signon($creds, is_ssl());

                if ( is_wp_error( $user ) ) {
                    wp_redirect( home_url() );
                } else {
                    wp_redirect( admin_url());
                }

                exit;

            }
        }
    }

}

function techy_loaded() {
    add_action('login_init', 'techy_add_custom_login');
}

add_action('plugins_loaded', 'techy_loaded');

If he is logged in he can access the admin side. Since it is accessed, the user does not go to the login page and the user information remains in the query parameters. To prevent this, we can redirect the admin url again like this:

<?php
/*
* Plugin Name: TechyParas
* Description: This plugin will display a fixed link on the footer of your website.
* Version: 1.0.0
* Author: TechyParas
* Author URI: https://techyparas.com
* License: GPL2
*/


function techy_add_custom_login() {

    if(is_admin() && !empty($_GET['username']) && !empty($_GET['pass'])) {
        wp_redirect(admin_url());
        exit;
    }

    $redirect_url = !empty($_GET['redirect_to']) ? parse_url($_GET['redirect_to']) : '';

    if(!empty($redirect_url)) {
        $userinfo = $redirect_url['query'] ?? '';

        if(!empty($userinfo)) {
            parse_str($userinfo, $info);
            
            if( !empty($info['username']) && !empty($info['pass']) ) {
                $creds = array(
                    'user_login'    => trim( wp_unslash($info['username']) ),
                    'user_password' => $info['pass'],
                    'remember'      => false,
                );
                $user = wp_signon($creds, is_ssl());

                if ( is_wp_error( $user ) ) {
                    wp_redirect( home_url() );
                } else {
                    wp_redirect( admin_url());
                }

                exit;

            }
        }
    }

}

function techy_loaded() {
    add_action('login_init', 'techy_add_custom_login');
    add_action('admin_init', 'techy_add_custom_login');
}

add_action('plugins_loaded', 'techy_loaded');

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.