Descrizione

Dalmatian Dream Login As User adds a secure “Login as user” action to the WordPress Users screen for administrators with the dedicated dd_switch_users capability.

The plugin uses opaque per-session switch tokens, server-side transient state, nonce-protected switch and return actions, strict target validation, safe redirects, and cleanup on logout. It blocks nested impersonation and protects multisite super administrator accounts.

The plugin does not send data to external services and does not include telemetry, advertising, or remote code.

Privacy

Dalmatian Dream Login As User does not transmit personal data to external services. Switch-session state is stored temporarily in the local WordPress database using transients and is removed when the session expires, the user returns to the administrator account, or the impersonated user logs out.

Installazione

Upload the dd-login-as-user folder to /wp-content/plugins/.
Activate the plugin through the Plugins screen in WordPress.
Administrators receive the dd_switch_users capability on activation.

FAQ

Who can switch users?: Only users with the dd_switch_users capability can start a switch session. The plugin adds that capability to the administrator role on activation.
Can administrators impersonate other administrators?: On single-site installs, administrator-to-administrator switching is blocked by default. Developers can opt in with the dd_login_as_user_allow_admin_target filter.
How long does a switch session last?: The default timeout is 60 minutes. It can be adjusted with the DD_LOGIN_AS_USER_TIMEOUT constant or the dd_login_as_user_timeout filter.

Recensioni

Non ci sono recensioni per questo plugin.

Contributi e sviluppo

“Dalmatian Dream Login As User” è un software open source. Le persone che hanno contribuito allo sviluppo di questo plugin sono indicate di seguito.

Boris Horvat

Traduci “Dalmatian Dream Login As User” nella tua lingua.

Ti interessa lo sviluppo?

Esplora il codice segui il repository SVN, segui il log delle modifiche tramite RSS.

Changelog

2.0.8

Removed unused storage of the original administrator WordPress session token.
Reduced temporary switch-session state to the minimum data required for secure account switching.

2.0.7

Prepared plugin metadata and documentation for WordPress.org Plugin Directory review.
Updated WordPress compatibility metadata.
Clarified privacy and local switch-session storage behavior.

2.0.6

Added the plugin languages folder.
Documented the intentional WordPress core login hook call for compatibility.

2.0.5

Restored the impersonated account early from the secure switch token when the WordPress auth cookie is not accepted.
Fired the standard WordPress login action after a successful switch.

2.0.4

Changed successful switch landing to the admin dashboard instead of the user profile screen.
Prevented cached profile redirects from blocking impersonation when profile access is hidden.
Set a persistent authentication cookie for the impersonated account.

2.0.3

Fixed Plugin Check internationalization and redirect sanitization findings.
Removed discouraged manual translation loading call.

2.0.2

Changed successful switch redirect to the impersonated user’s profile panel.

2.0.1

Fixed blank page after switching to another user.
Fixed blank page after returning to the administrator account.
Improved safe local redirect handling after account switches.

2.0.0

Reworked user impersonation session security.
Added unique switch-session tokens.
Added secure return-to-administrator workflow.
Added dedicated switch capability.
Added multisite and administrator-target protections.
Improved nonce, input sanitization and redirect handling.
Added internationalization support.
Removed production debug output.
Added lightweight audit hooks.
Improved WordPress.org / Plugin Check compatibility.