danielbachhuber/one-time-login

Generate a one-time login URL for any user

one-time-login's Issues

`wp plugin install --force --version=0.4.0 one-time-login` installs v0.3.1 version

I've installed one-time-login with wp-cli:

$ wp plugin install --force --version=0.4.0 one-time-login
Installing One Time Login (0.4.0)
Downloading installation package from https://downloads.wordpress.org/plugin/one-time-login.0.4.0.zip...
The authenticity of one-time-login.0.4.0.zip could not be verified as no signature was found.
Unpacking the package...
Installing the plugin...
Removing the old version of the plugin...
Plugin updated successfully.
Success: Installed 1 of 1 plugins.

Checksums OK:

$ wp plugin verify-checksums one-time-login
Success: Verified 1 of 1 plugins.

But it's not the v0.4.0 version. Even the plugin header has 0.3.1.

$ wp plugin get one-time-login
+-------------+-----------------------------------------------------------+
| Field       | Value                                                     |
+-------------+-----------------------------------------------------------+
| name        | one-time-login                                            |
| title       | One Time Login                                            |
| author      | Daniel Bachhuber                                          |
| version     | 0.3.1                                                     |
| description | Use WP-CLI to generate a one-time login URL for any user. |
| status      | active                                                    |
+-------------+-----------------------------------------------------------+

I've also diffed the downloaded plugin file (one-time-login.php) with versions from this repo (master, v0.4.0) and it's definitely not v0.3.1, but strangely it differs from v0.3.1 also...

Am I missing something?

Doesn't work with object caching

We use Redis for object caching and usermeta by default is a cached group. So when a token is generated and saved to the usermeta table it's not saved in Redis. When trying to login using the URL it returns an invalid token error because $tokens var is empty.

A quick fix is to stop caching the usermeta table.

I was thinking maybe it's worth saving tokens somewhere else, to continue caching the usermeta group. Possibly using wp_cache_add if object caching is active and wp_cache_delete to delete it.

Link user to login screen from error message

If a user's one-time login link expires, it would be helpful if we pointed them to an alternative way of logging in (e.g. the login screen).

restAPI: rest_forbidden 401

Hello, I tried to use the restAPI in your plugin.
And unfortunately I get a "401" "rest_forbidden" as an answer.

Can somebody help me with it?

API endpoint

Now, that WordPress implemented application passwords für API requests, what do you think about adding an API endpoint, to generate "one time tokens"?

Generate multiple one-time login links

As a plugin user, it would be helpful to be able to generate multiple one-time login links so they can be cached in some external system for later use.

Allow redirection after login

With the standard WordPress login flow, you can pass the redirect_to URL param when loading wp-login.php to specify a page the user will end up on once completing the login process. It would be great if this could be handled by this plugin either by processing the redirect_to param, or by a new optional argument when creating the token.

The login_redirect hook should be available to the plugin within this context.

Expire one-time login links

Currently, the one-time login link lasts for as long as the plugin is active. We should probably expire the link at some point.

update wordpress.org version

Thanks for a great plugin! Wordpress states:

This plugin hasn’t been tested with the latest 3 major releases of WordPress. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress.

As far as I can tell it works fine with the latest WordPress (5.4), can you verify this and push an update to wordpress.org stating compatibility? Thanks!
https://wordpress.org/plugins/one-time-login/

Fix use of $assoc_args

It's not actually passed through to the command.

Add button to form

Need add button for page login in form