tbenyon

Hey Kyle,

Apologies for the delayed response.

You’ve used the word migrate which gives me the impression that the old service will be killed off in replacement for WordPress.

The plugin as it stands is designed for when you’ve got another live service running that handles forgotten passwords and changes to details.

If this is not what you need however we could look at an alternative.

One thing that jumps out at me is that the password hashing method is not ideal in the system you’re currently using for at least one reason I specify in the ‘Security Notes’ for the plugin (speed of hashing algorithm).

For this reason the solution we look at to solve your problem may benefit from converting old user passwords into the way WordPress handles it by default.

Can you confirm that you are looking to kill off the old system and then we can start to discuss what you are looking for.

I could publish another plugin with a lot of the same logic but looking at user migration for you. I think it would be confusing to do what you want in the current plugin for other users.

Thanks,

Tom

Hey @anemos2k,

Thanks for your thoughts. I agree with most of what you’ve said but I think in regard to blocking roles, I’ll probably just add to the list of roles to map to block login so it’s all tied in to the drop down. Partly because I can develop that quicker and may iterate a change to the UI later.

It sounds like the checking an additional field is of more importance to you at this stage so I’ll start work on that first.

I think I’ll implement this with a separate section called “Exclude Users”.
It will have:
– A checkbox to activate the functionality
– A box to type the field name where the blocking state is stored
– A text field to type the value that should be blocked
– EXTENSION – Make the text field repeatable so multiple values can be blocked. E.g. if they are marked as “deleted” or “banned”

Starting work on this now. Let me know if you are not happy with the above.

Tom

You’ve made my day Mike!

Thank you very much!

Let me know if you run into any other issues 🙂

Tom

I would LOVE to do that but I’ve been told off before for this by the moderation team.

Although you hypothetically could find me on FB or Linked In I can’t share contact information on here or gain access to your system due to security issues. Which makes sense as it would mean developers potentially getting access to peoples live systems – potentially with malicious intent.

Are you running this site locally or on a server? Are you comfortable modifying some code for me to add more logging to the local JS?

The file that is doing this check is here:
/wp-content/plugins/external-login/js/exlog_test.js

Could you swap the code to:

(function ($) {
    $(function () {
        var $modal = $(".exlog_modal");
        var $loader = $(".exlog_loader_container");
        var $modal_content_container = $(".exlog_test_results_inner_container", $modal);
        var $modal_test_results = $(".exlog_test_results", $modal);
        var $modal_error = $(".exlog_test_fail", $modal_content_container);
        var $modal_error_title = $(".exlog-error-title", $modal_error);
        var $modal_error_message = $(".exlog-error-message", $modal_error);
        var $wordpressBaseUrlContainer = $('[data-exlog-wp-base]');
        var wordpressBaseUrl = $wordpressBaseUrlContainer.attr('data-exlog-wp-base');

      console.log("EXLOG - Base container length: ", $wordpressBaseUrlContainer.length);
      console.log("EXLOG - Base container URL: ", wordpressBaseUrl);

      var error_messages = {
            unknown: {
                title: "Error",
                message: "This is an unknown error."
            },
            lost: {
              title: "Error",
              message: "Could not access the server to run the test."
            },
            server: {
                title: "Error",
                message: "There was an error on the server."
            },
            empty_result: {
              title: "Error",
              message: "No data returned from the server. Please check your settings."
            }
        };

        var error_codes = {
          100: error_messages.unknown,       // Ajax returned, unknown error
          101: error_messages.unknown,       // Unknown error passed to error handler
          404: error_messages.lost,          // 404 from Ajax
          500: error_messages.server,        // 500 from server - see test_results.php?
          501: error_messages.server,        // String of "0" returned - caused by missing function?
          502: error_messages.server,        // 500ish error from Ajax
          600: error_messages.empty_result,  // Empty AJAX response
          601: error_messages.empty_result   // Blank string AJAX response
//        999: ????????????????????????      // Hard coded in markup case this system fails
        };

        function errorMessageState(error_code) {
          console.log("EXLOG - Error message state ran");
          console.log("EXLOG - Error code: ", error_code);

          if (!error_code) {
            $modal_error.hide();
          }

          if (!error_codes.hasOwnProperty(error_code)) {
            error_code = 101;
          }

          console.log("EXLOG - Error code validated: ", error_code);
          var error_data = error_codes[error_code];

          console.log("EXLOG - All error codes: ", error_codes);
          console.log("EXLOG - Error data: ", error_data);

          console.log("EXLOG - Error title length: ", $modal_error_title.length);
          console.log("EXLOG - Error message length :", $modal_error_message.length);

          $modal_error_title.text(error_data.title + ": " + error_code);
          $modal_error_message.text(error_data.message);

          $modal_error.show();
        }

        $(".exlog_close_button", $modal).click(function () {
            $modal_error.hide();
            $modal.hide();
            $modal_test_results.text("");
        });

        $("input.exlog_test_connection").click(function () {
            $modal.show();
            $loader.show();
            var data = {
                'action': 'exlog_test_connection',
                'test_results': 10
            };

          console.log("EXLOG - Error AJAX about to run.");
          console.log("EXLOG - Base URL = ", wordpressBaseUrl);
          console.log("EXLOG - Whole URL = ", wordpressBaseUrl + "/wp-admin/admin-ajax.php");

          $.ajax({
                type: "GET",
                url: wordpressBaseUrl + "/wp-admin/admin-ajax.php",
                data: data,
                success: function (data) {
                    if (!data) {
                      errorMessageState(600);
                      $modal_error.show();
                    } else if (data == "") {
                      errorMessageState(601);
                      $modal_error.show();
                    } else if (data === "0") {
                      errorMessageState(501);
                      $modal_error.show();
                    } else {
                      $modal_error.hide();
                      $modal_test_results.append(data);
                    }
                    $loader.hide();
                },
                error: function (xhr, ajaxOptions, thrownError){
                  if(xhr.status == 404) {
                    errorMessageState(404);
                  } else if (xhr.status === 500) {
                    errorMessageState(500);
                  } else if (Math.floor(xhr.status / 100) === 5) {
                    errorMessageState(502);
                  } else {
                    errorMessageState(100);
                  }
                  $loader.hide();
                }
            });
        });
    });
}(jQuery));

I would then be interested to see what console logs you now get.

Thanks,

Tom

Hey Mike,

Really sorry.

Can you please check something for me?

Could you please check the options page container with the class “exlog_options_page”. It should have a data attribute called “data-exlog-wp-base” which should store your site url.

I would expect it to be “https://mywebsite/portal/blog“.

The JS should be using that as the base for the request.

If it is there, the front end JS isn’t grabbing that correctly or not using it correctly.

If it is not there I know there is a PHO issue.

Thanks,

Tom

Hi Mike,

Had a look at this today and I’ve fixed it on my local copy.

I’m just doing tweaks to the error message you should have gotten.

However, the issue was isolated to the test button so the actual integration should work.

As always, backup your db before testing.

I’ll send another message once I’ve got it deployed. Won’t be home till late tonight and daughter is sick so you may have to wait till tomorrow.

If it makes a big difference to get this out in the next few later tonight (UK time) let me know and I’ll stay up and get it done.

Thanks,

Tom

Hey @anemos2k,

I find it hard to choose which features to add and how to implement them. My goals are:
– To not overcomplicate the user experience of the plugin
– To prioritise features that will be of use to as many users as possible

I welcome your opinion in making this decision.

I’ve had another user that had a feature request similar to yours but you have flagged one downside to it.

The feature would be to allow you to choose another field in the external user table that represented if the user was allowed to log in or not. The complication comes if there are more than two states in that field. I would have to allow the UI to accept “if this is true and not this” etc.

One downside would be that if a user logged in once, they had that field changed, the external db was offline and the WP data was being used this would not get updated. This is the nature of all systems getting out of sync. I could make it so that when a user logs in and they are not allowed to login – if a user is in the WP database – delete them.

Or I could make it so certain roles from the external login are not allowed to login. I could add “No login” instead of a role to the role mappings section and bloke those roles.

Advice welcome on which approach!

Regarding the SQL query, my plan was to not allow the user to modify the authentication query for logging in, but to write a PHP function that developers would be able to call on pages to query the external database. It would use the credentials stored in the plugin but allow a developer to easily grab more data and I could just return the results as a PHP array.

Is this what you had in mind or not really?

Thanks,

Tom

• This reply was modified 7 years, 7 months ago by tbenyon. Reason: Clarity and typos corrected