[Defender Pro] Compatibility Issue with Temporary Login Without Password plugin.

I am a developer of Temporary Login Without Password plugin and one of our user, facing compatibility issue with Defender Pro plugin.

If force 2 factor authentication is enabled for particular role and when temporary user try to login with temporary link, at that time they are redirecting to Profile page to enable 2 factor authentication but TLWP restrict access of Profile page and throws Permission denied message.

  • Nastia
    • Support Rock Star

    Hello Malay Ladu

    Hope you're doing well!

    I could replicate the issue on my end and flagged it to our developers, so they would provide some feedback.

    As a workaround, please deactivate "Force users to log in with two-factor authentication" option. This will allow the Temporary Login to work. Please see attached this screenshot:

    Hope this helps!

    Kind regards,

    Nastia

  • Panos
    • SLS

    Hi Malay Ladu !

    That’s a very interesting plugin you have there!!

    Unfortunately there is no filter that can deactivate the 2 factor auth in Defender per user, so for now I can only suggest a workaround.

    You ( or your meber ) could either use a custom user role that doesn’t have 2FA active and use only that role for for creating Temporary Logins, or some custom snippet that is a bit hackish :

    // Make sure user has auth set
    add_action( 'user_register', function( $user_id ){

    if (
    ! isset( $_POST['wtlwp_data'] ) || empty( $_POST['wtlwp_data'] ) ||
    empty( $_POST['wtlwp-nonce'] ) || ! wp_verify_nonce( $_POST['wtlwp-nonce'], 'wtlwp_generate_login_url' ) ||
    ( ! empty( $_POST['wtlwp_action'] ) && 'update' === $_POST['wtlwp_action'] ) ) {
    return;
    }

    update_user_meta( $user_id, 'defenderAuthOn', 1 );
    update_user_meta( $user_id, 'defenderForceAuth', 1 );

    } );

    // Remove Defender's action that asks for 6 digit passcode upon login
    add_action( 'wp_login', function( $userLogin, $user ){

    $is_temp_user = get_user_meta( $user->ID, '_wtlwp_user', true );

    if ( ! empty( $is_temp_user ) && '1' == $is_temp_user ) {

    global $wp_filter;
    $tag = 'wp_login';
    $hook_method = 'maybeShowOTPLogin';
    $hook_class = 'WP_Defender\Module\Advanced_Tools\Controller\Main';

    if ( ! isset( $wp_filter[$tag] ) ) {
    return;
    }

    foreach ( $wp_filter[$tag]->callbacks as $key => $callback_array ) {

    foreach ( $callback_array as $c_key => $callback ) {

    if ( substr_compare( $c_key, $hook_method, strlen( $c_key )-strlen( $hook_method ), strlen( $hook_method ) ) === 0 ) {
    if ( $callback['function'][0] instanceof $hook_class ){
    unset( $wp_filter[$tag]->callbacks[$key][$c_key] );
    }
    }
    }
    }
    }

    },8, 2 );

    Hope this helps for now! In the meantime this will be reviewed by main developer and see if it is likely to add a filter per user, which would be very handy in this case. Can’t promise though that such filter will be added as it depends on how many requests have been for this feature.

    Kind regards!

Thank NAME, for their help.

Let NAME know exactly why they deserved these points.

Gift a custom amount of points.