I solved my problem, and it could definitely help others too. The problem was with cookies since my folder structure was like this : mysite.com mysite.com/mypage.php mysite/wordpress/ the cookies were only valid for wordpress folder, and it’s subdirectories. In order to activate the cookies outside wordpress, I installed the root Cookie plugin, and everything works … Read more
Before core version 4.0 the authentication depended only on cookies. Starting with 4.0 core introduced its own sessions (WP_Session_Tokens) to better handle security things. Note that these are not PHP sessions, they are implemented purely by WordPress and use user meta as storage. Unfortunately I don’t think there is any clear documentation for this feature. … Read more
First of all get user by Phone no. $user = reset( get_users( array( ‘meta_key’ => ‘PHONE_META_KEY_HERE’, ‘meta_value’ => $USER_PHONE_NO_HERE, ‘number’ => 1, ‘count_total’ => false ) ) ); Now check if Password matches with the user we retrived by phone. if($user){ if(wp_check_password($USER_PASSWORD_HERE, $user->user_pass, $user->ID)){ // Success. User login credentials matched. Login user with `wp_set_auth_cookie`. wp_clear_auth_cookie(); … Read more
Here’s the full working code, put it in functions.php: add_action(‘login_form’,’my_added_login_field’); function my_added_login_field(){ ?> <p> <label for=”my_extra_field”>I agree to the terms<br /> <input type=”checkbox” value=”1″ class=”input” id=”my_extra_field” name=”my_extra_field_name”/></label> </p> <?php } function check_checkbox($user, $password) { if( !isset($_POST[‘my_extra_field_name’]) ) { remove_action(‘authenticate’, ‘wp_authenticate_username_password’, 20); $user = new WP_Error( ‘denied’, __(“<strong>ERROR</strong>: Please agree to our terms.”) ); } return … Read more
if you are logged in wp_parse_auth_cookie(LOGGED_IN_COOKIE); will return array consisting wp user name, cookie hash and expiration time. This function will return null if you are not logged in. But you cannot get plain password as wordpress doesn’t store plain password.
Take a look at the source: 832 if ( $remember ) { 833 /** 834 * Filter the duration of the authentication cookie expiration period. 835 * 836 * @since 2.8.0 837 * 838 * @param int $length Duration of the expiration period in seconds. 839 * @param int $user_id User ID. 840 * @param … Read more
You might want to read this post about passwords protected posts. In short: Do not use them. QUESTION: Will this strategy keep the info private, or am I missing something? No, it won’t. It will even leak info to search engines and index those. What you can do is to just require the actual user … Read more
You can reset your/a password in a number of ways. The easiest way is to use a specific function. Or you can do it through MySQL command line or phpMyAdmin, if you have it. Therefore, you have to get your database credentials (if you don’t have those already), which you can find in your wp-config.php … Read more
Each call to an admin page loads the \wp-admin\admin.php file. For example, from the \wp-admin\index.php file: /** Load WordPress Bootstrap */ require_once( dirname( __FILE__ ) . ‘/admin.php’ ); In that file auth_redirect() is called. From \wp-admin\admin.php: require_once(ABSPATH . ‘wp-admin/includes/admin.php’); auth_redirect(); // Schedule trash collection if ( !wp_next_scheduled(‘wp_scheduled_delete’) && !defined(‘WP_INSTALLING’) ) wp_schedule_event(time(), ‘daily’, ‘wp_scheduled_delete’); set_screen_options(); auth_redirect() … Read more
There are a few different hooks you can use (from wp_signon): wp_authenticate (action) authenticate (filter) wp_login (action) But you may do best to override the pluggable wp_authenticate (from wp-includes/pluggable.php): if ( !function_exists(‘wp_authenticate’) ) : /** * Checks a user’s login information and logs them in if it checks out. * * @since 2.5.0 * * … Read more