Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: Use init hook to execute login bypass #440

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

WIP: Use init hook to execute login bypass #440

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f31c2fc
Use init hook to execute login bypass
ypcs Aug 13, 2020
9b3b3cc
Fix reference to wrong class
ypcs Aug 14, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 17 additions & 2 deletions modules/seravotest-auth-bypass.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,19 +12,34 @@
die('Access denied!');
}

if ( ! class_exists('Seravotest_User_Login') ) {
if ( ! class_exists('Seravotest_Auth_Bypass') ) {
class Seravotest_Auth_Bypass {

public static function load() {

// Check for permission to enter only if flag is set
if ( isset($_GET['seravotest-auth-bypass']) ) {
add_action('login_init', array( __CLASS__, 'attempt_login' ), 10, 2);
add_action('login_init', array( __CLASS__, 'attempt_login' ), 10, 2);

// Restrict Content Pro has it's own processing for login forms,
// and it doesn't run login_init. This prevents auth bypass from working.
// So, let's add override for this plugin.
//add_action('rcp_login_form_errors', array( __CLASS__, 'attempt_login' ), 10, 2);
// RCP hooks to init with priority 10, so now we catch request before RCP, and we're
// able to do our magic
add_action('init', array( __CLASS__, 'attempt_login' ), 9, 2);
}

}

/**
* Catch login attempt using seravotest-auth-bypass
**/
public static function attempt_login() {
// If our key hasn't been set, stop processing here.
if ( ! isset($_GET) || ! isset($_GET['seravotest-auth-bypass']) ) {
return;
}
// If special authentication bypass key is found, check if a matching
// key is found, and if soautomatically login user and redirect to wp-admin.
$key = get_transient('seravotest-auth-bypass-key');
Expand Down