Insights on Ruby, Git, jQuery, Cappuccino, WordPress, Debian and OS X. Please subscribe if you find something useful!

A WordPress Skeleton Key

Posted: October 29th, 2009 | Author: Jerod | Filed under: Projects, WordPress | View Comments

File this one under “scratching my own itch”

A Problem

I often use WordPress as a CMS and have a couple of sites with many users contributing. I rarely go a week without an email or phone call from a user who needs help posting. When it comes to remote support there is no substitute for seeing what they’re seeing.

However, if you want to login to the site with their user account you have to either ask for their password (tacky & insecure) or reset their password temporarily (amateurish & annoying).

A Solution


large_SkeletonKeyP
Say goodbye to the days of tacky, amateurish, insecure & annoying. The Skeleton Key plugin allows WordPress administrators (level 10 users) to login to the site as any user by authenticating with the user’s login and their own (administrator) password. Once logged in, you are that user. Handy, huh?

***UPDATE***
The plugin has already gotten some TLC and it is now more performant and secure. We are now requiring admins to login with their own login followed by a “+” followed by the user’s login. This will cut down on the chances of people guessing administrative passwords. In a weird, corny way the “+” is your digital skeleton key… so to login as user “joeblow” as an admin I would provide:

username = admin+joeblow
password = [the admin's password]
/***UPDATE***

An Explanation

This plugin is dead simple. It hooks into WordPress’ authentication chain using 2.8′s new ‘authenticate‘ hook. The Skeleton Key’s function sets its priority higher than the built-in authentication functions and checks the password against the admin account provided before the “+” in the database. If the check fails it returns an error and the next function in the chain is called (like normal). If it matches, the Skeleton Key hands back the user account tied to the login and you’re good to go.

The source is on GitHub, like usual. Feel free to grok it & provide feedback if interested.

View Comments on “A WordPress Skeleton Key”

  1. 1 Douglas Neiner said at 11:48 am on October 29th, 2009:

    So, what if two admins have the same password? Or… does it not matter because regardless they are an admin?

  2. 2 Jerod Santo said at 11:57 am on October 29th, 2009:

    Yah, two admins with same password shouldn't cause any problems because the first one to match will simply return the desired user account and let you pass.

    Now, this plugin really does let admins login as ANYBODY, including other admins. If you don't trust your admin users, don't use this plugin. Or better yet, don't let them be admins ;)

  3. 3 uberVU - social comments said at 6:31 pm on November 7th, 2009:

    Social comments and analytics for this post…

    This post was mentioned on Twitter by sant0sk1: A WordPress Skeleton Key: http://bit.ly/2nOluk...

  4. 4 scribu said at 3:08 am on November 8th, 2009:

    Have you tried the User Switching plugin? It does the same thing, basically.

  5. 5 A WordPress Skeleton Key | blogt0sk1 said at 2:52 am on November 8th, 2009:

    [...] the original: A WordPress Skeleton Key | blogt0sk1 Comments0 Leave a Reply Click here to cancel [...]

  6. 6 Jerod Santo said at 3:09 pm on November 8th, 2009:

    No I had never heard of it. I always search for existing plugins that provide solutions for my needs before I write my own, but this one didn't hit my radar.

    Oh well, I guess we have two options now ;)

  7. 7 A WordPress Skeleton Key | WordPress News said at 6:45 pm on November 8th, 2009:

    [...] Read more: A WordPress Skeleton Key [...]

  8. 8 Wordpress como CMS: Ingresa con una llave maestra | Eliseos.net said at 5:20 pm on November 9th, 2009:

    [...] de ese usuario.Pero hoy en día ha salido a la luz un plugin que trabaja como una llave maestra: The Skeleton Key. El fin de este plugin es que el administrador, usuario con privilegio del nivel 10, pueda [...]

  9. 9 clippingimages said at 3:07 pm on November 10th, 2009:

    Nice and informative post. Something cool to learn. Thanks for sharing this nice post.

  10. 10 clippingimages said at 11:07 pm on November 10th, 2009:

    Nice and informative post. Something cool to learn. Thanks for sharing this nice post.

  11. 11 Derosa said at 10:47 pm on March 9th, 2010:

    …

    Skoro eto sluchitsya …

  12. 12 Gene said at 2:47 am on April 7th, 2010:

    Thanks for this great plugin, I wrote a couple of comments on WP's plugin repo.

  13. 13 Philip Light said at 8:48 pm on April 15th, 2010:

    Beautiful! I have a WordPress help website and often need to go in to someone's account to add their email questions as forum posts. This makes that far, far easier. Thanks!

  14. 14 Karan Lippard said at 1:57 am on August 22nd, 2010:

    Wow – now that’s perspective! Please more like this!

blog comments powered by Disqus