检查post密码(出于某种原因)发生在get_the_content()
, 这似乎是合法的,但实际上把两个不同的问题混在了一起。你说得对,没有办法解决get_the_content()
显示密码表单。下面是core中密码检查的详细操作:
if ( empty( $post->post_password ) )
return false;
if ( ! isset( $_COOKIE[\'wp-postpass_\' . COOKIEHASH] ) )
return true;
require_once ABSPATH . WPINC . \'/class-phpass.php\';
$hasher = new PasswordHash( 8, true );
$hash = wp_unslash( $_COOKIE[ \'wp-postpass_\' . COOKIEHASH ] );
if ( 0 !== strpos( $hash, \'$P$B\' ) )
return true;
return ! $hasher->CheckPassword( $post->post_password, $hash );
如您所见,密码将根据存储在用户计算机上的Cookie进行检查。
要绕过post密码,您实际上必须通过设置此cookie来授予用户显式权限。Core采用以下方式:
setcookie(
\'wp-postpass_\' . COOKIEHASH,
$hasher->HashPassword( wp_unslash( $_POST[\'post_password\'] ) ),
$expire,
COOKIEPATH
);
当你看到
the_post_password()
, 它用于检索(纯文本密码),然后您会发现它除了逃避用户安全的论点外,什么都不做:
esc_attr( $post->post_password )
现在,您可以将其组合起来,在显示模板中的内容之前设置Cookie:
// Your custom check for the `$_GET` content
// …also check if there in fact is a password
// …and if the user is a repeated visitor, do not set the Cookie again
if (
isset( $_GET[\'circumvent\'] )
and \'disable-pass\' === $_GET[\'circumvent\']
and isset( $post->post_password )
and ! isset( \'wp-postpass_\'.COOKIEHASH )
) {
// Finally we use the plain text password to set the Cookie
// as if the user would have entered it into the password form
setcookie(
\'wp-postpass_\'.COOKIEHASH,
$hasher->HashPassword( wp_unslash( esc_attr( $post->post_password ) ) ),
$expire,
COOKIEPATH
);
}
// Now display the content:
the_content();
附加
information 关于这篇文章中的Post密码,我写了很多关于这一概念的文章,但我们知之甚少,您可能想了解其中的一些细节