What I meant, was that I use it with WordPess 3.2.1. Sorry for the typo.

I have now found that the problem is incompatibility with another plugin, the only one I did not deacktivate while testing.

I will now dig in deeper, and find out which of the two plugins really doing something wrong, before requesting it fixed.

Again, sorry.

You should really update to the latest version of WordPress (3.2, and 3.3 is right around the corner) as the plugin won’t be actively supporting older versions.

No problems until I switch user.

After hearing Ozh mention the coding was clean, I read the whole script, very clean and hardly any wasted code. The only thing I wasn’t too keen on was the use of the softer ‘and’ instead of ‘&&’.. but that’s just me.

The only feature I would like to have would be the ability to switch back to the original account that has the correct caps and user_level faster. That is a real tricky proposition security-wise, but I had a few ideas that may or may not help you if you decide to try for it.

Looking at the way the cookies are created, using the username, substr of hashed pass, and time..

Backup the target accounts password, then replace with your password. That way you can generate the correct authorization cookies for any user because you know their username and password. So the only thing that changes when all users have the same password hash, is the username. Thats where if you just replaced the target users password with yours, you would always be able to gen the right hash.

Along those lines, you could create copies of the entire users and usermeta tables, and then replace all of the users password hashes to a known value. Then you could have wordpress use those temporarily by defining this:


/** CUSTOM_USER_TABLE and CUSTOM_USER_META_TABLE are used to designated that the user and usermeta tables normally utilized by WordPress are not used, instead these values/tables are used to store your user information. */
define('CUSTOM_USER_TABLE', $table_prefix . 'my_users');
define('CUSTOM_USER_META_TABLE', $table_prefix . 'my_usermeta');


At the least, you could create the cookies for each user that way, and all you need is a way to quickly switch the cookies you use. And, you are still the only one who knows your admins real credentials (as long as you don’t still send the admin cookies while logged in as another user, which they might be able to see through logs or xss), so it should prevent a backhack.

It’s an interesting excercise to think about, but oh ya I’m on the clock!

* Fix the ‘Switch back to’ menu item in the WordPress admin bar (WordPress 3.1+).
* Fix a formatting issue on the user profile page.

John

1) Add a “switch back” link to the admin bar
2) Have an optional setting to configure a “Become user” link in the admin bar for the site admin. That was the admin can easily switch back and forth between their administrative persona and normal user profile.

Any idea ?