Make password invalid once logged out of password-protected page

2 Views

In a WP-based site I have a custom form which I need to hide from the general public and give access to only a select few who would then get a password from me, enter it and access the form and submit it. On form submission, I redirect them to another page. I have employed this bit of code below in my functions.php, which logs them out of the password-protected page, once redirected: 

add_action( 'wp', 'post_pw_sess_expire' );
    function post_pw_sess_expire() {
    if ( isset( $_COOKIE['wp-postpass_' . COOKIEHASH] ) )
    // Setting a time of 0 in setcookie() forces the cookie to expire with the session
    setcookie('wp-postpass_' . COOKIEHASH, '', 0, COOKIEPATH);
}

Now the twist: once any of these select few are logged out of the password-protected page, I need the password to become invalid. Not necessarily, but sort of like a one-time password. A solution would be great, or please give me some pointers or alternatives if it’s not possible.

Post Views: 2

Related posts

2 comments

  1. After submitting the form and before redirecting to new page, reset the current user’s password.

    A simple wp_update_user(array('ID' => $userid, 'user_pass' => 'YourNewPaSSword')); will do everything for you.

  2. I did this small test and it works, but I have no idea if it’s technically correct:

    add_action( 'wp', 'post_pw_sess_expire' );

function post_pw_sess_expire() 
{
    if ( isset( $_COOKIE['wp-postpass_' . COOKIEHASH] ) )
    {
        // Setting a time of 0 in setcookie() forces the cookie to expire with the session
        setcookie('wp-postpass_' . COOKIEHASH, '', 0, COOKIEPATH);
        add_action( 'wp_footer', 'change_pw_wpse_119986' );
    }
}

function change_pw_wpse_119986()
{
    global $post;
    if( $post->post_password == md5('something') )
        return;
    $post->post_password = md5('something');
    wp_update_post( $post );
    remove_action( 'wp_footer', 'change_pw_wpse_119986' );
}

    But there’s a bigger problem: we have one password per page, not one password per person. Once the first one enters the pass, the next ones won’t be able to use it. You’ll need to build your own solution setting different passwords and unsetting each one as soon as the person uses it.

Comments are closed.