Watrix Login as User
| 开发者 | watrix |
|---|---|
| 更新时间 | 2026年7月2日 15:56 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Watrix Login as User lets administrators sign in as any other user (impersonation) and return to their own account with a single click. It is useful for support requests, reproducing user-reported issues, debugging role and capability problems, and verifying the experience of subscribers, customers or editors without sharing passwords.
Key features:
- Adds a "Switch to" row action on the Users screen (localised as "切り替え" in Japanese).
- Adds a "Switch to %s" button on the user profile edit screen.
- Displays a persistent red warning bar in both the admin and the front-end while an impersonation session is active.
- The warning bar contains a one-click link back to the original administrator account.
- Switching and switching-back are protected by nonces and a signed cookie (HMAC-SHA256, AUTH_KEY-derived) so the original user id cannot be forged.
- A bounded audit log (latest 200 entries) is stored in a single options row.
- Only users who are administrators AND hold the manage_options capability can switch (manage_network_users on multisite).
- The original (acting) user id is stored in a signed, Secure / HttpOnly / SameSite=Lax cookie.
- Nonce verification, self-switch prevention and clean-up on user deletion are implemented.
- If the AUTH_KEY salts required for signing are missing, the plugin fails closed and the feature is disabled.
安装:
- Upload the plugin to
wp-content/plugins/watrix-login-as-user/or install it from the WordPress plugin directory. - Activate the plugin from the Plugins screen.
- Go to Users and use the "Switch to" row action, or open a user's profile and use the "Switch to %s" button.
- While impersonating, use the red warning bar at the top of the screen to return to your original account.
屏幕截图:
常见问题:
Who can switch users?
Only users who are administrators AND have the manage_options capability (manage_network_users on multisite). The capability is re-checked on every switch and on every restore.
Is my password ever sent to the impersonated session?
No. Switching uses WordPress' own authentication cookies (wp_set_auth_cookie). No password is ever read, written or transmitted by this plugin.
What happens if I deactivate the plugin while impersonating?
The impersonation cookie is cleared on deactivation, so the next request will not sit on a stale impersonation state.
Where is the audit log stored?
In a single wp_options row (watrix_lau_audit_log), capped at the most recent 200 entries. Uninstalling the plugin removes this option completely.
更新日志:
1.0.3
- Rename: plugin renamed from "Watrix User Switching" to "Watrix Login as User"; slug / text domain changed from
watrix-user-switchingtowatrix-login-as-userto avoid confusion with the existing User Switching plugin. - Internals: constant, function, class, option, cookie, nonce and query-parameter prefixes updated accordingly (
WATRIX_LOGIN_AS_USER_*,WATRIX_LAU_*,watrix_login_as_user_*,watrix_lau_*,WatrixLoginAsUser\,watrix_lau_original,watrix_lau_audit_log,?watrix_lau=...). - i18n: translation catalogue renamed to
watrix-login-as-user-ja.po/.mo. - No functional or behavioural changes.
- Compliance: pass WordPress.org Plugin Check 2.0.0 with zero errors and zero warnings.
- readme.txt: rewritten in English; "Tested up to" bumped to 7.0; Japanese description retained below.
- i18n: removed redundant
load_plugin_textdomain()call (WP 4.6+ auto-loads translations for WP.org-hosted plugins). - uninstall.php: prefixed local variables (
$watrix_lau_option_name,$watrix_lau_site_ids,$watrix_lau_site_id). - i18n: moved
/* translators: */comments to be immediately adjacent to the__()call. - nonce warnings: annotated the
admin_initand admin-notice dispatchers (read-only status checks; the actual state-changing actions still verify nonces). - Packaging: added
.distignoreso.git,.gitignore,README.mdand.DS_Storeare excluded from the distribution ZIP.
- i18n: switched UI strings to English source + translation catalogues. Japanese locale displays "切り替え" / "%s に切り替え"; other locales show "Switch to" / "Switch to %s".
- Security (H-1): removed the fallback signing secret. The plugin now fails closed when AUTH_KEY salts are not configured.
- Public failure codes coarsened; detailed reasons now live only in the audit log (S-4).
- Added
uninstall.phpto fully remove the audit-log option on plugin deletion (S-6). - Deactivation hook clears any in-flight impersonation cookie (S-6).
- Reworked the user-edit screen UI to use a single dedicated form-table instead of a stray
<tr>injection (L-4). - Standardised on output-time escaping (S-1).
- Fixed mismatched
/* translators: */placeholders (L-1). - Bundled a compiled Japanese .mo file.
- Initial release.