seravo-plugin icon indicating copy to clipboard operation
seravo-plugin copied to clipboard

WIP: Use init hook to execute login bypass

Open ypcs opened this issue 5 years ago • 2 comments

Customer notified us about wp-test testsuite not working on their site, which uses Restrict Content Pro for providing login form. It seems that this plugin completely overrides WordPress login processing, and doesn't trigger login_init action at all.

Based on WordPress developer documentation https://developer.wordpress.org/reference/hooks/login_init/ this hook should be fired when login form is initialized, but it seems that RCP has done it's own decisions to skip the hook.

Instead of login-specific hook RCP uses WordPress core init, which gets triggered on every page load. This might affect site performance, as it basically means that every single pageload runs at least some if checks related to login functionality.

This commit modifies how our test suite login bypass feature works, by hooking to that init hook. We first check if visitor is trying to do the bypass, and only if certain variable has been defined, we continue with the checks. This seems to fix the issue with RCP.

However, as this modifies how all sites do the login bypass, this modification needs lots of testing before we can start using this. Also, as this makes WP run some bypass checks on each page load, it might affect WordPress performance. This means that we need to conduct extensive benchmarking before merging this.

ypcs avatar Aug 13 '20 14:08 ypcs

Seems that hookin to RCP function described in initial version isn't working, but if we hook to init before RCP does, that would do the job. However, this would also mean that on every pageload we run couple lines of the bypass check code, so if we'd like to continue with this path, we would need to do some benchmarking about effects of this.

ypcs avatar Aug 14 '20 05:08 ypcs

Note, PR still contains some extra comments that should be removed before merging. However, this now needs at least benchmarking, and optionally comments from sites using this.

ypcs avatar Aug 14 '20 07:08 ypcs