Dalmatian Dream Login As User

Dalmatian Dream Login As User adds a secure "Login as user" action to the WordPress Users screen for administrators with the dedicated dd_switch_users capability. The plugin uses opaque per-session switch tokens, server-side transient state, nonce-protected switch and return actions, strict target validation, safe redirects, and cleanup on logout. It blocks nested impersonation and protects multisite super administrator accounts. The plugin does not send data to external services and does not include telemetry, advertising, or remote code. When switching accounts, the plugin preserves the administrator WordPress session in encrypted server-side state and creates a temporary target-user session. On return, it validates the administrator session and destroys only the temporary target session. AIOWPS logged-in-user tracking is temporarily suspended only while setting switch-related authentication cookies, so account switching does not appear as a new login. Other authentication listeners remain active.

2.0.13

• Prevented AIOWPS logged-in-user tracking from recording administrative user switches and returns as new logins.
• Temporarily suspended only AIOWPS's set_auth_cookie tracking callback while setting switch cookies; restored it immediately afterward.
• Preserved normal authentication callbacks and genuine login tracking.

2.0.12

• Preserved the original administrator WordPress session token in encrypted server-side switch state.
• Restored the existing administrator session after validating native and supported session-limiter expiry, without creating an additional administrator session.
• Destroyed only the temporary impersonated-user WordPress session on successful return, leaving other devices untouched.
• Corrected the impersonated-user session token expiration argument.

2.0.11

• Added impersonation-session fingerprint tracking for integrations that distinguish account switching from genuine login/logout events.
• Avoided emitting the standard WordPress login action for administrative impersonation.

2.0.8

• Removed unused storage of the original administrator WordPress session token.
• Reduced temporary switch-session state to the minimum data required for secure account switching.

2.0.7

• Prepared plugin metadata and documentation for WordPress.org Plugin Directory review.
• Updated WordPress compatibility metadata.
• Clarified privacy and local switch-session storage behavior.

2.0.6

• Added the plugin languages folder.
• Documented the intentional WordPress core login hook call for compatibility.

2.0.5

• Restored the impersonated account early from the secure switch token when the WordPress auth cookie is not accepted.
• Fired the standard WordPress login action after a successful switch.

2.0.4

• Changed successful switch landing to the admin dashboard instead of the user profile screen.
• Prevented cached profile redirects from blocking impersonation when profile access is hidden.
• Set a persistent authentication cookie for the impersonated account.

2.0.3

• Fixed Plugin Check internationalization and redirect sanitization findings.
• Removed discouraged manual translation loading call.

2.0.2

• Changed successful switch redirect to the impersonated user's profile panel.

2.0.1

• Fixed blank page after switching to another user.
• Fixed blank page after returning to the administrator account.
• Improved safe local redirect handling after account switches.

2.0.0

• Reworked user impersonation session security.
• Added unique switch-session tokens.
• Added secure return-to-administrator workflow.
• Added dedicated switch capability.
• Added multisite and administrator-target protections.
• Improved nonce, input sanitization and redirect handling.
• Added internationalization support.
• Removed production debug output.
• Added lightweight audit hooks.
• Improved WordPress.org / Plugin Check compatibility.