0

I need to restrict access to certain frontend pages, based on a user_meta field.

All works fine, except when the user is already logged in but with the wrong credentials. In that situation I would want them to be redirected to the login form (with a message encouraging them to logout and login again with suitable credentials - I can do that bit).

Instead, the user ends up with the "redirecting in a way that will never complete" message.

I think the only bit of my code that's relevant to this issue is:

if(!$user_is_approved) {
    wp_redirect(wp_login_url( get_permalink() ));
    exit;
}

What's the best way of achieving this?

1

When you say that the user is "logged in but with the wrong credentials" I have to assume you mean "the user is logged in with correct credentials but does not have the permissions needed to access the page". If users were able to log in with the wrong credentials you site would be badly broken.

That redirect, all by itself, won't cause the error you describe. You can prove that by pasting the following into your theme's header.php:

wp_redirect(wp_login_url( get_permalink() ));
exit;

Any attempt to get to a front end page will redirect but there is no infinite redirect loop. The problem must be where you have placed that code and you don't include that information. I expect you have it somewhere-- a hook maybe-- that loads for the login page as well so that when the redirect gets started it never stops (until the browser gives up). Sorting that out will probably solve the issue at hand.

I have to wonder why you are using a user meta field instead of a capability, though. I don't see why the built in permissions system can't handle this.

9
  • Thanks. Yes "the user is logged in with correct credentials but does not have the permissions needed to access the page" - I was being lazy! Using user meta because the third-party plugin I'm playing with (Train-Up!) does it this way - but I'll dig deeper to see if there's a corresponding capability I can use. May 4 '13 at 14:39
  • I'll now check the rest of my code to see if I can identify the infinite loop. Will report back soon. May 4 '13 at 14:50
  • I doubt there will be a corresponding capability, but you can make one. If your plugin is already doing something different, it could be a major rewrite to re-engineer it.
    – s_ha_dum
    May 4 '13 at 14:55
  • I tried your experiment (pasting it into index.php which I use for all frontend pages, and removing all my own redirection/access stuff). And I do end up with an infinite loop as soon as I login! Huh?? May 4 '13 at 15:30
  • With Twenty Twelve on a mostly pristine 3.5.1 install, I don't get an infinite loop. Do you have customized login pages? To be clear, if you are redirected to the front of the site after you login you will always end up on the login page. What I mean by an "infinite loop" is a loop that causes the browser to trigger its self defense mechanisms and print the "redirecting in a way that will never complete" message.
    – s_ha_dum
    May 4 '13 at 15:37
0

Thanks to @s_ha_dum I eventually tracked the issue down to the following line in my wp-config.php file...

@define('ADMIN_COOKIE_PATH', '/');

Commenting this out solved the problem

Ironically, I've tended to include this line as a standard preventative measure against login redirection loops. (Can't remember where I first got this from, but there's some lively debate on the topic here.) I suppose this illustrates the dangers of using magic incantations without really understanding what they're doing..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.