A client is using a shopping cart and has manual checkout turned off for everyone except admin. They would like to be able to switch to a user to push an order through so they can track each users order history but still want the ability to manually checkout.

If there is a way to check if the current user has used your plugin to log in? If there is I think I can work this out.

Thanks for the plugin, it is great and an amazing time saver for testing sites.

Alex

BTW there was never any formatting issue on our listing page (using PlatformPro). Is there anyway this option can be brought back? Doing it via Dashboard>>Users is such a pain I’ve created dummy accounts with various rights levels so I can quickly log in & out to check things. Which I’d rather not do. Great work, anyway – all the praise above is due!

There’s a bug in BuddyPress which was causing the button to not appear, but it looks like my attempt to get around it doesn’t always work.

Is this a bug in my installation or a planned change? I only ever used Switch to from the members page – having to go to the dashboard first, then clicking on “users”, then “switch to” is a bit of a pain.

Thanks for all the code comments :)

I was hired to do a security and performance audit of your plugin. Out of around 50 plugins I checked, yours comes out on top.

What I meant, was that I use it with WordPess 3.2.1. Sorry for the typo.

I have now found that the problem is incompatibility with another plugin, the only one I did not deacktivate while testing.

I will now dig in deeper, and find out which of the two plugins really doing something wrong, before requesting it fixed.

Again, sorry.

You should really update to the latest version of WordPress (3.2, and 3.3 is right around the corner) as the plugin won’t be actively supporting older versions.

No problems until I switch user.

After hearing Ozh mention the coding was clean, I read the whole script, very clean and hardly any wasted code. The only thing I wasn’t too keen on was the use of the softer ‘and’ instead of ‘&&’.. but that’s just me.

The only feature I would like to have would be the ability to switch back to the original account that has the correct caps and user_level faster. That is a real tricky proposition security-wise, but I had a few ideas that may or may not help you if you decide to try for it.

Looking at the way the cookies are created, using the username, substr of hashed pass, and time..

Backup the target accounts password, then replace with your password. That way you can generate the correct authorization cookies for any user because you know their username and password. So the only thing that changes when all users have the same password hash, is the username. Thats where if you just replaced the target users password with yours, you would always be able to gen the right hash.

Along those lines, you could create copies of the entire users and usermeta tables, and then replace all of the users password hashes to a known value. Then you could have wordpress use those temporarily by defining this:


/** CUSTOM_USER_TABLE and CUSTOM_USER_META_TABLE are used to designated that the user and usermeta tables normally utilized by WordPress are not used, instead these values/tables are used to store your user information. */
define('CUSTOM_USER_TABLE', $table_prefix . 'my_users');
define('CUSTOM_USER_META_TABLE', $table_prefix . 'my_usermeta');


At the least, you could create the cookies for each user that way, and all you need is a way to quickly switch the cookies you use. And, you are still the only one who knows your admins real credentials (as long as you don’t still send the admin cookies while logged in as another user, which they might be able to see through logs or xss), so it should prevent a backhack.

It’s an interesting excercise to think about, but oh ya I’m on the clock!

* Fix the ‘Switch back to’ menu item in the WordPress admin bar (WordPress 3.1+).
* Fix a formatting issue on the user profile page.

John