Allow bypassing protection?

[Uwe Trenkner]

I need to allow a server in our network unprotected access to WP posts otherwise protected by Simple Membership (via wget).

Is there a configuration/hook that would make it possible to allow access for requests with a certain secret GET-Parameter? E.g. could I somehow allow a request like this full access to post #123: https://www.mydomain.com/?p=123&allow=9Uxc5bNxJbjFHB5K6EfR

Or else for requests from a certain IP address?

[mbrsolution]

Hi, are you referring to something like this

https://simple-membership-plugin.com/simple-membership-api-querying-member-account-using-http-post-request/

Regards

[Uwe Trenkner]

Thank you for the link. But the API is only about members. I am looking for a possibility to allow a server in our network access to protected content. The server could be identified by IP address and or some GET-Parameter (similar to how you use the API key).

I know how I can achieve this by adding a single line of code to the validation function of SWMP. But I would like to not go down this route as I would have to re-do this after every upgrade of SWPM. That’s why I was looking for an “official” way which works without changing the source code.

[mbrsolution]

Hi, unfortunately there is no option in the plugin at the moment to achieve what you are trying to do.

I know how I can achieve this by adding a single line of code to the validation function of SWMP. But I would like to not go down this route as I would have to re-do this after every upgrade of SWPM. That’s why I was looking for an “official” way which works without changing the source code.

You might like to try your solution. If you don’t mind, you might like to share your solution here for others to use. The developers will also check your code and decide if they can use it or not.

Kind regards

[Uwe Trenkner]

Sure, I gladly share my hack – maybe it helps others, too:

I add in /simple-membership/classes/class.swpm-access-control.php between line 19 and 20

if (isset($_GET['swpm-bypass']) and $_GET['swpm-bypass']=='9Uxc5bNxJbjFHB5K6EfR'){
	return true;
}

This allows full access to the post if I add the GET-variable swpm-bypass=9Uxc5bNxJbjFHB5K6EfR to the URL, e.g. https://www.mydomain.com/my-great-post-title/?swpm-bypass=9Uxc5bNxJbjFHB5K6EfR

Note, only use this on HTTPS websites – otherwise the string will go unencrypted over the internet…

And, of course, don’t use 9Uxc5bNxJbjFHB5K6EfR as your “bypass-word”. It’s just an example.

[mbrsolution]

Thank you for sharing 🙂 your solution.

Enjoy the plugin.

[admin]

Thank you. I will be happy to add an action or filter hook somewhere that will allow you to override this from your custom code (without having to modify the core plugin’s code). If you make the proposed solution/suggestion for the hook, I will look into add it to the code.

[Uwe Trenkner]

@admin Thank you for the offer – I have not yet looked into how this would look like with a hook.

But I wanted to post a warning and fix here, for everyone: I noticed that in certain situations WordPress redirects pages with the whole QUERY-string. If that URL is exposed to e.g. a user, he gets to know the secret bypass string.

I therefore trigger the bypass now via an HTTP header, which is never returned by WordPress. And in order to make the code portable, I decided to use a hash of WP’s auth salt. This way the secret bypass string is unique to every WP installation. In class.swpm-access-control.php, I now start the can_i_read_post() function like this:

    public function can_i_read_post($post){
        if ( isset( $_SERVER['HTTP_X_SWPM_BYPASS'] ) ){
                $bypass_key = hash( 'sha256', wp_salt('auth') );
                if ( $_SERVER['HTTP_X_SWPM_BYPASS'] == $bypass_key ){
                        return true;
                }
        }
...

[Author]

Posts