danielgm

@jakept

You’re right, that function does work for posts.

I used the template name instead of the full file name when I tested.

This worked for me:

is_page_template( 'single-custom.php' )

Thanks so much!

Theme-my-Login is good for always redirecting to the same URL depending on the user role. I was thinking about something more flexible and spontaneous.

You would know where to redirect by remembering the initial URL called.

Examples:

https://wp-site.com/?wtlwp_token=0e17194f4463cc51730cb0fef7c44280 -> log in and redirect 302 -> https://wp-site.com/

https://wp-site.com/category/widgets/?wtlwp_token=0e17194f4463cc51730cb0fef7c44280 -> log in and redirect 302 -> https://wp-site.com/category/widgets/

https://wp-site.com/post-title?wtlwp_token=0e17194f4463cc51730cb0fef7c44280 -> log in and redirect 302 -> https://wp-site.com/post-title

https://wp-site.com/wp-admin/edit.php?wtlwp_token=0e17194f4463cc51730cb0fef7c44280 -> log in and redirect 302 -> https://wp-site.com/wp-admin/edit.php

In the plugin backend, you would only generate:

https://wp-site.com/wp-admin/?wtlwp_token=0e17194f4463cc51730cb0fef7c44280 -> log in and redirect 302 -> https://wp-site.com/wp-admin/

But you could put an info box explaining that it’s possible to append the token to other URLs in order to have the temporary user visit that particular page directly, with the privileges afforded by the chosen user role.

I fixed it like this for now:

.copied-text-message {
    padding: 0 20px 20px 20px;
}

admin/css/wp-temporary-login-without-password-admin.css

Do you see any other options to get rid of this scenario? We will think about different alternatives of this and will be incorporated into plugin.

Not at the moment, no. Looking forward to your next updates!

Oh, that’s right regarding plugins and themes. I forgot about the use case of someone setting up the whole installation for the owner. But this is a high-trust scenario anyway.

It seems the main scenario is some plugin dev is given access to look into a problem with his plugin on the owner’s site.

In that case, allowing access to plugin installation means the third party can install a backup plugin and walk away with the whole database and every file in the installation and the owner wouldn’t even know this happened.

Even staging sites often contain significant intellectual property and/or user data.

You’re already restricting a few things for temporary users such as adding or deleting users which are not explained on the plugin settings page. I think there should be an explanation about these restrictions on that page.

Perhaps you could then present additional checkboxes when an admin temp login is created like so:

1) I fully trust this party (blocks only plugin itself, user editing/deleting)
2) Disallow plugin/theme installation
3) Disallow users.php
4) Disallow popular backup plugins already installed

With a notice that other plugins may also be exposing private information or providing file level access and a hook for developers to add those to the block list.

What do you think?

Ah, that’s too bad. PHP 7 has been out for quite a while now and it brings a major speed boost. Hope you’ll get around to it soon.

So I used the following code:

add_filter( 'fb_og_image_additional', 'extra_preview_images' );

function extra_preview_images() {
        $fb_image_additional = array(
            'https://domain.com/wp-content/uploads/og_image2.jpg',
            'https://domain.com/wp-content/uploads/og_image3.jpg'
        );
        return $fb_image_additional;
}

But somehow this outputs only the first letter of each new image url:

<meta property="og:image" content="h"/>
<meta property="og:image" content="h"/>