从另一个站点自动登录wordpress仪表板

Question

我想从另一个站点自动登录到WP管理员/仪表板而不通过登录过程..我已经尝试了以下但没有运气:

<?php

$username="admin";
$password="mypasw";
$url="http://example.com/";
$cookie="cookie.txt";

$postdata = "log=". $username ."&pwd=". $password ."&wp-submit=Log%20In&redirect_to=". $url ."wp-admin/&testcookie=1";
$ch = curl_init();
curl_setopt ($ch, CURLOPT_URL, $url . "wp-login.php");
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6");
curl_setopt ($ch, CURLOPT_TIMEOUT, 60);
curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_COOKIEJAR, $cookie);
curl_setopt ($ch, CURLOPT_REFERER, $url . "wp-admin/");
curl_setopt ($ch, CURLOPT_POSTFIELDS, $postdata);
curl_setopt ($ch, CURLOPT_POST, 1);
$result = curl_exec ($ch);
curl_close($ch);
echo $result;
exit;


?>

这有点像只显示我的仪表板页面,但我没有真正登录,因为点击管理页面上的任何按钮只是重定向到相同的页面,这是网站页面.. :(

Answer 1

如果您有权访问您尝试登录的网站的文件.你可以添加一个自动登录php脚本和$ _POST用户名和密码到这个脚本,例如:

if ($_POST) {

    $errors = array();

    $username = esc_sql($_REQUEST['username']);
    $password = esc_sql($_REQUEST['password']);
    $remember = esc_sql($_REQUEST['rememberme']);
    $remember = ($remember) ? "true" : "false";

    $login_data = array();
    $login_data['user_login'] = $username;
    $login_data['user_password'] = $password;
    $login_data['remember'] = $remember;
    $user_verify = wp_signon($login_data, true);

    if (is_wp_error($user_verify)) {
        $errors[] = 'Invalid username or password. Please try again!';
    } else {
        wp_set_auth_cookie($user_verify->ID);
        wp_redirect(admin_url());
        exit;
    }

}

Wordpress codex参考:

• 登录功能:http://codex.wordpress.org/Function_Reference/wp_signon
• 为管理员登录设置cookie http://codex.wordpress.org/Function_Reference/wp_set_auth_cookie
• 获取管理页面网址:http://codex.wordpress.org/Function_Reference/admin_url

希望能帮助到你.

编辑: $ wpdb->自Wordpress版本3.6以来不推荐使用escape,而是使用wpdb :: prepare()或esc_sql()代替!我已经将代码更改为使用esc_sql().

• esc_sql():http://codex.wordpress.org/Function_Reference/esc_sql