admin-post.php and the login mask

  • Resolved Devomo

    (@devfirst)


    2 years, 8 months ago

    Hi there,

    I am working on a site with a slow import script that is called via a webhook. To reduce the load on the server calling the webhook, I have used WP Async Task (https://github.com/techcrunch/wp-async-task). Internally, it uses admin-post.php to make tasks asynchronous. This works fine as long as one is logged in. But when not logged in, Defender seems to block access to admin-post.php. When I disable the login masking feature, it works, but when it’s activated, the admin_post handler never gets called.

    Is there a way around this?

    Thanks in advance!

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Support Nebu John – WPMU DEV Support

    (@wpmudevsupport14)

    2 years, 8 months ago

    Hi @devfirst,

    Thank you for reaching out to us.

    Can you please add the following code as a mu plugin and check if that resolves the issue? 

    add_action( 'wp_async_save_post', function(){
		add_filter( 'wd_mask_login_enable', '__return_false' );
	}, 1 );

    Please find how to install a mu-plugin here: https://wpmudev.com/docs/using-wordpress/installing-wordpress-plugins/#installing-mu-plugins

    Please let us know how that goes.

    Best Regards,
    Nebu John

    Plugin Support Patrick – WPMU DEV Support

    (@wpmudevsupport12)

    2 years, 8 months ago

    Hi @devfirst

    I hope you are doing well and safe!

    We haven’t heard from you in a while, I’ll mark this thread as resolved.

    Feel free to let us know if you have any additional questions or problems.

    Best Regards
    Patrick Freitas

    Thread Starter Devomo

    (@devfirst)

    2 years, 8 months ago

    Hi @wpmudevsupport12 @wpmudevsupport14,

    Thanks for the reply! I was on vacation, that’s why it took me a while to respond. The solution Nebu suggested didn’t work for me, but it did point me in the right direction.

    The wp_async_save_post hook does not run at the time when it is needed, which is when WP handles the request to admin-post.php. And that is where the problem is.

    The problem is not specifically related to WP Async Task. It is related to all requests that use the admin_post_nopriv and admin_post_nopriv_{$action} hooks. These hooks are never reached as long as the login mask is enabled.

    To solve this, I created a mu-plugin with the following code:

    <?php

if ( isset( $_POST['action'] ) && $_POST['action'] === 'wp_async_my_action' ) {
    add_filter( 'wd_mask_login_enable', '__return_false' );
}

    (my_action has a different name in my project.)

    So I look whether the request has a POST action, and if so, if it’s the correct one. And then it disables the mask. I realize that this is not the safest option ever, so I tried verifying the _nonce that WP_Async_Task sends along with its requests, but it seems the above code runs so early that the wp_verify_nonce function is not defined yet. Anyway, at least it gets the job done 😉

    Thanks for helping me out!

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘admin-post.php and the login mask’ is closed to new replies.