使用add_rewrite_rule 或add_rewrite_endpoint 要捕获HASHorSOMETHINGcrazyANDrandom.
Hashids 还可以帮助您生成一个哈希，稍后可以读取。
$hashids = new Hashids\\Hashids(\'this is my salt\');
$post_id = 1;
$request_id = 2;
$random = 3;
$crazy_id = $hashids->encode($post_id, $request_id, $random);
$numbers = $hashids->decode($crazy_id);
<小时>
UPDATE #1
这将创建两个端点：
http://example.com/CPT/{代码}/{哈希}
http://example.com/CPT/{代码}/
在这两种情况下，每次都会使用新链接生成一个新哈希。因为我正在使用wp_hash_password 我循环直到密码不包含/ 所以它不会破坏URL。我相信有更好的方法，但是。。。它适用于此测试。普通密码基于SERVER_NAME + {CODE} 这是从第一个参数中提取的。
每个哈希URL都是唯一的，但如果与正确的代码一起使用，则始终会进行验证。
<小时>
if( ! class_exists(\'HashPoint\')):
class HashPoint {
const ENDPOINT_NAME = \'CPT\'; // endpoint to capture
const ENDPOINT_QUERY_NAME = \'__cpt\'; // turns to param
// WordPress hooks
public function init() {
add_filter(\'query_vars\', array($this, \'add_query_vars\'), 0);
add_action(\'parse_request\', array($this, \'sniff_requests\'), 0);
add_action(\'init\', array($this, \'add_endpoint\'), 0);
}
// Add public query vars
public function add_query_vars($vars) {
$vars[] = static::ENDPOINT_QUERY_NAME;
$vars[] = \'code\';
$vars[] = \'hash\';
return $vars;
}
// Add API Endpoint
public function add_endpoint() {
add_rewrite_rule(\'^\' . static::ENDPOINT_NAME . \'/([^/]*)/([^/]*)/?\', \'index.php?\' . static::ENDPOINT_QUERY_NAME . \'=1&code=$matches[1]&hash=$matches[2]\', \'top\');
add_rewrite_rule(\'^\' . static::ENDPOINT_NAME . \'/([^/]*)/?\', \'index.php?\' . static::ENDPOINT_QUERY_NAME . \'=1&code=$matches[1]\', \'top\');
flush_rewrite_rules(false); //// <---------- REMOVE THIS WHEN DONE
}
// Sniff Requests
public function sniff_requests($wp_query) {
global $wp;
if(isset($wp->query_vars[ static::ENDPOINT_QUERY_NAME ])) {
$this->handle_request(); // handle it
}
}
// Handle Requests
protected function handle_request() {
// Control the template used
add_filter(\'template_include\', function($original_template) {
// global $wp_query;
// var_dump ( $wp_query->query_vars );
// var_dump($original_template);
return get_template_directory() . \'/crazy-hash.php\';
});
}
}
$hashEP = new HashPoint();
$hashEP->init();
endif; // HashPoint
一
<?php
/**
* Template Name: Crazy Hash
*/
get_header();
global $wp_query;
$code = $wp_query->query_vars[ \'code\' ];
$hash = empty($wp_query->query_vars[ \'hash\' ]) ? \'NONE\' : $wp_query->query_vars[ \'hash\' ];
$hash = urldecode($hash);
echo \'Code : \' . $code;
echo \'<br />\';
echo \'Hash : \' . $hash;
echo \'<br />\';
echo \'<br />\';
require_once(ABSPATH . \'wp-includes/class-phpass.php\');
$wp_hasher = new PasswordHash(8, true);
$plain = $_SERVER[ \'SERVER_NAME\' ] . \'-\' . $code;
$hash_mash = wp_hash_password($plain);
// make sure we don\'t have any `/` to break the url
while(strpos($hash_mash, \'/\')) {
$hash_mash = wp_hash_password($plain);
}
echo \'Valid?<br />\';
if($wp_hasher->CheckPassword($plain, $hash)) {
echo "YES, Matched<br /><br />";
}
else {
echo "No, BAD HASH!!!<br /><br />";
}
$url = get_home_url(NULL, \'CPT/\' . $code . \'/\' . urlencode($hash_mash));
echo "Try this Hash : <a href=\\"$url\\">$hash_mash</a>";
echo \'<br /><br />\';
// ... more ...
get_footer();
<小时>UPDATE #2 | LIFETIME NONCE
对于@birgire-要获得一生的暂时性，您不需要删除wp_nonce_tick() 从…起wp_create_nonce?function wp_create_lifetime_nonce($action = - 1) {
$user = wp_get_current_user();
$uid = (int) $user->ID;
if( ! $uid) {
$uid = apply_filters(\'lifetime_nonce_user_logged_out\', $uid, $action);
}
$token = wp_get_session_token();
$i = 0;//wp_nonce_tick(); -- time is not a factor anymore
return substr(wp_hash($i . \'|\' . $action . \'|\' . $uid . \'|\' . $token, \'nonce\'), - 12, 10);
}
function wp_verify_lifetime_nonce($nonce, $action = - 1) {
$nonce = (string) $nonce;
$user = wp_get_current_user();
$uid = (int) $user->ID;
if( ! $uid) {
$uid = apply_filters(\'lifetime_nonce_user_logged_out\', $uid, $action);
}
if(empty($nonce)) {
return false;
}
$token = wp_get_session_token();
$i = 0; //wp_nonce_tick(); -- time is not a factor anymore
// Nonce generated anytime ago
$expected = substr(wp_hash($i . \'|\' . $action . \'|\' . $uid . \'|\' . $token, \'nonce\'), - 12, 10);
if(hash_equals($expected, $nonce)) {
return 1;
}
do_action(\'wp_verify_lifetime_nonce_failed\', $nonce, $action, $user, $token);
// Invalid nonce
return false;
}
<小时>$code = \'OI812\';
$lifetime_nonce = wp_create_lifetime_nonce($code);
$nonce = wp_create_nonce($code);
echo "<pre>";
print_r(
array(
$code,
$lifetime_nonce,
$nonce,
! wp_verify_nonce($nonce, $code) ? \'FAILED\' : \'WORKED\',
! wp_verify_lifetime_nonce($lifetime_nonce, $code) ? \'FAILED\' : \'WORKED\',
));
echo "</pre>";
