Dalmatian Dream Login As User
| 开发者 | whitedd |
|---|---|
| 更新时间 | 2026年9月2日 16:31 |
| PHP版本: | 8.1 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPL-2.0-or-later |
| 版权网址: | 版权信息 |
详情介绍:
Dalmatian Dream Login As User adds a secure "Login as user" action to the WordPress Users screen for administrators with the dedicated
dd_switch_users capability.
The plugin uses opaque per-session switch tokens, server-side transient state, nonce-protected switch and return actions, strict target validation, safe redirects, and cleanup on logout. It blocks nested impersonation and protects multisite super administrator accounts.
The plugin does not send data to external services and does not include telemetry, advertising, or remote code.
安装:
- Upload the
dd-login-as-userfolder to/wp-content/plugins/. - Activate the plugin through the Plugins screen in WordPress.
- Administrators receive the
dd_switch_userscapability on activation.
常见问题:
Who can switch users?
Only users with the dd_switch_users capability can start a switch session. The plugin adds that capability to the administrator role on activation.
Can administrators impersonate other administrators?
On single-site installs, administrator-to-administrator switching is blocked by default. Developers can opt in with the dd_login_as_user_allow_admin_target filter.
How long does a switch session last?
The default timeout is 60 minutes. It can be adjusted with the DD_LOGIN_AS_USER_TIMEOUT constant or the dd_login_as_user_timeout filter.
更新日志:
2.0.8
- Removed unused storage of the original administrator WordPress session token.
- Reduced temporary switch-session state to the minimum data required for secure account switching.
- Prepared plugin metadata and documentation for WordPress.org Plugin Directory review.
- Updated WordPress compatibility metadata.
- Clarified privacy and local switch-session storage behavior.
- Added the plugin languages folder.
- Documented the intentional WordPress core login hook call for compatibility.
- Restored the impersonated account early from the secure switch token when the WordPress auth cookie is not accepted.
- Fired the standard WordPress login action after a successful switch.
- Changed successful switch landing to the admin dashboard instead of the user profile screen.
- Prevented cached profile redirects from blocking impersonation when profile access is hidden.
- Set a persistent authentication cookie for the impersonated account.
- Fixed Plugin Check internationalization and redirect sanitization findings.
- Removed discouraged manual translation loading call.
- Changed successful switch redirect to the impersonated user's profile panel.
- Fixed blank page after switching to another user.
- Fixed blank page after returning to the administrator account.
- Improved safe local redirect handling after account switches.
- Reworked user impersonation session security.
- Added unique switch-session tokens.
- Added secure return-to-administrator workflow.
- Added dedicated switch capability.
- Added multisite and administrator-target protections.
- Improved nonce, input sanitization and redirect handling.
- Added internationalization support.
- Removed production debug output.
- Added lightweight audit hooks.
- Improved WordPress.org / Plugin Check compatibility.