调查过滤器authenticate, 我们可以发现它被称为inside 功能wp_authenticate, 这是一个pluggable function.
这意味着它可以被我们自己制造的替代。
这是original function, 加上标记的入口点：
function wp_authenticate($username, $password) {
$username = sanitize_user($username);
$password = trim($password);
$user = apply_filters(\'authenticate\', null, $username, $password);
/* ENTRY POINT */
if ( $user == null ) {
// TODO what should the error message be? (Or would these even happen?)
// Only needed if all authentication handlers fail to return anything.
$user = new WP_Error(\'authentication_failed\', __(\'<strong>ERROR</strong>: Invalid username or incorrect password.\'));
}
$ignore_codes = array(\'empty_username\', \'empty_password\');
if (is_wp_error($user) && !in_array($user->get_error_code(), $ignore_codes) ) {
do_action(\'wp_login_failed\', $username);
}
return $user;
}
The
test was done 创建
wp_authenticate a中的函数
Must Use plugin. 在这个切入点上，我提出了以下内容：
global $wpdb;
$table = $wpdb->prefix . \'my_users\';
$parent = $wpdb->get_row(
$wpdb->prepare(
"SELECT * FROM $table WHERE name=\'$username\'"
)
);
if( $username == $parent->name && $password == $parent->password )
$user = get_user_by( \'id\', $parent->id );
桌子
wp_my_users 是一个简单的测试表，密码甚至是纯文本
<小时>The matter 是如何构建$user 对象完全基于自定义表。或者如果可行或可取。。。
因为在这个测试中，用户的ID是相同的，所以我们正在回馈(get_user_by) 从用户自己的表中按WordPresswp_users, 但在自定义表中检查凭据wp_my_users.
<小时>Notes:
这个答案并不超出对函数的分析和黑客攻击wp_authenticate. 未考虑安全性、密码管理或wp_usermeta 桌子
作为参考，这是$user:
user | WP_User Object
(
[data] => stdClass Object
(
[ID] => 1
[user_login] => rod
[user_pass] => $P$BQ8qnb3iYPRzisxYHUKq5X/GCQqhoz1
[user_nicename] => rod
[user_email] => [email protected]
[user_url] =>
[user_registered] => 2012-09-21 14:39:01
[user_activation_key] =>
[user_status] => 0
[display_name] => rod
)
[ID] => 1
[caps] => Array
(
[administrator] => 1
)
[cap_key] => wp_capabilities
[roles] => Array
(
[0] => administrator
)
[allcaps] => Array
(
[switch_themes] => 1
[edit_themes] => 1
[activate_plugins] => 1
[edit_plugins] => 1
[edit_users] => 1
[edit_files] => 1
[manage_options] => 1
[moderate_comments] => 1
[manage_categories] => 1
[manage_links] => 1
[upload_files] => 1
[import] => 1
[unfiltered_html] => 1
[edit_posts] => 1
[edit_others_posts] => 1
[edit_published_posts] => 1
[publish_posts] => 1
[edit_pages] => 1
[read] => 1
[level_10] => 1
[level_9] => 1
[level_8] => 1
[level_7] => 1
[level_6] => 1
[level_5] => 1
[level_4] => 1
[level_3] => 1
[level_2] => 1
[level_1] => 1
[level_0] => 1
[edit_others_pages] => 1
[edit_published_pages] => 1
[publish_pages] => 1
[delete_pages] => 1
[delete_others_pages] => 1
[delete_published_pages] => 1
[delete_posts] => 1
[delete_others_posts] => 1
[delete_published_posts] => 1
[delete_private_posts] => 1
[edit_private_posts] => 1
[read_private_posts] => 1
[delete_private_pages] => 1
[edit_private_pages] => 1
[read_private_pages] => 1
[delete_users] => 1
[create_users] => 1
[unfiltered_upload] => 1
[edit_dashboard] => 1
[update_plugins] => 1
[delete_plugins] => 1
[install_plugins] => 1
[update_themes] => 1
[install_themes] => 1
[update_core] => 1
[list_users] => 1
[remove_users] => 1
[add_users] => 1
[promote_users] => 1
[edit_theme_options] => 1
[delete_themes] => 1
[export] => 1
[administrator] => 1
)
[filter] =>
)
