When you enqueue or localize a script you’re doing it specifically for the front end or the admin. If you want to enqueue or localize a script in both, you have to specifically do it for both. This is used to enqueue/localize for the front end add_action( ‘wp_enqueue_scripts’, ‘your_function_front’ ); your_function_front() { wp_localize_script(‘scripts’, ‘myAjax’, array( … Read more
This is the line you’re looking for: $userdata = get_user_by(‘login’, $username); The get_user_by function calls WP_User::get_data_by and that function eventually executes this SQL: SELECT * FROM $wpdb->users WHERE user_login = $username The hashed password will be contained in the results of that query. Eventually, the wp_check_password function will be called to compare the hashes.
The port of Apache web server is only used for HTTP protocol, that is actually serving web pages. It is different from file transfer protocols and Apache itself actually doesn’t implement those functions, they are handled by their own server software. If SFTP port isn’t default, you should look up in the documentation or contact … Read more
juste before testing login and password, you have the action wp_authenticate: https://codex.wordpress.org/Plugin_API/Action_Reference/wp_authenticate juste after test and only if logging is successful, the action wp_login: https://codex.wordpress.org/Plugin_API/Action_Reference/wp_login and after logging, you can also modify the URL with the filter login_redirect: https://codex.wordpress.org/Plugin_API/Filter_Reference/login_redirect
No as it will be insecure to do it. Being able to display the password to the user means that you store it as a plain text somewhere which is a big no no. Emails ending in spam should not be relevant here as you should not send passwords in email. (sure you can hack … Read more
After researching and looking up the WordPress Codex, this is the code that I have used to authenticate.. I hope this helpful to all friends .it’s working fine for me 🙂 $creds = array( ‘user_login’ => $username, ‘user_password’ => $userpassword, ‘remember’ => true ); if(!empty($username) && !empty($userpassword)) { if(!username_exists($username)) { $userdata = array( ‘user_login’ => … Read more
Can they for example simply copy the cookie and “be” logged in as the user who was the original cookie owner? Yes! with the cookie they basically have your login session. You do not want 3rd parties to get the cookie. Keep in mind there is more than 1 cookie, for frontend and for backend. … Read more
Yes, you can hook determine_current_user. This is how WordPress calls the existing code that processes authentication cookies: add_filter( ‘determine_current_user’, ‘wp_validate_auth_cookie’ ); add_filter( ‘determine_current_user’, ‘wp_validate_logged_in_cookie’, 20 ); e.g. see the implementations of those in wp-includes/pluggable.php. Your filter should return the user ID of the user you want to authenticate as once you’ve processed the headers. That … Read more
If you looked at your plugins one by one and none of them causes the problem, look at your template files that display your home page – could be index.php, home.php, content.php, content-{slug/id}.php or page-templates/…, depending on your theme and settings. Look for if (!is_user_logged_in()) { auth_redirect(); } or anything that seems to resemble this. … Read more
You do not need to rewrite wp_set_auth_cookie(), it allows you to change the expiration time of the cookie: add_filter( ‘auth_cookie_expiration’, ‘wpse101378_change_expire_time’, 3 ); function wpse101378_change_expire_time( $expire, $user_id, $remember ){ //The $remember variable indicates whether the user has elected //to be ‘remembered’. //By default, if true, WP sets expire to 14 days if false, 2 days … Read more