內容簡介
這個外掛讓管理員可以為其 WordPress 網站生成自動登入連結，並以特定使用者名稱登入訪客。管理員可以編輯（生成和刪除）使用者的自動登入連結，而使用者只能查看其自動登入連結。請注意，此外掛會繞過 WordPress 通過登入名稱和密碼的標準驗證方法，並且應僅在您理解以下和外掛網站上提到的安全問題後方可使用。
使用方法
啟用此外掛後，管理員可以在不同使用者的編輯資料管理頁面上生成自動登入連結。使用者可以在其個人資料頁面上查看其自動登入連結。自動登入連結的格式為：
http://yoursite/[子目錄/]?autologin_code=ABC123
自版本 1.05 起，為了更方便，直接使用 WordPress 的預覽網站功能就能生成自動登入連結。當以管理員身份登入並查看頁面時，在頂部欄中會顯示額外的項目「自動登入連結」。指向該選單項目時，下拉列表將列出所有已在其個人資料頁面上生成過自動登入連結的使用者。單擊某個使用者時，將彈出一個視窗，顯示可以自動登入訪客為所選用戶並將其帶到當前頁面的連結。
安全問題
由於自動登入連結是一種開放的網站登錄方式，可以在其使用者個人資料頁面上查看，因此這可能被認為是 WordPress 的不安全外掛。我盡力讓它盡可能安全，以滿足自己的需求，但這導致了一些設計上的選擇，這可能不會讓所有管理員都滿意：
自動登入代碼以純文本形式保存。這意味著任何能夠在 WordPress 數據庫上執行查詢的人（外掛、管理員、系統管理員）都可以獲得某個使用者的自動登入代碼。我計劃擴展此外掛，使登入代碼作為雜湊值保存。然而，這又帶來了一個缺點，即無法重新顯示一旦生成的登入連結。
這是最嚴重的問題。有關此問題的可能安全問題的完整自我評估，請訪問外掛網站。
外掛標籤
開發者團隊
原文外掛簡介
This plugin allows admininstators to generate autologin links for their
WordPress website, logging in visitors under a certain user name. Administrators
can edit (generate and delete) autologin links for users, users can only view
their autologin links. Note that This plugin bypasses the standard
authentication method of wordpress via login and password and should only be
used if you understand the security issues mentioned below and on the
plugin website.
Usage
Once this plugin is activated, administrators can generate autologin links on
the edit profile administration pages for different users. Users can view their
autlogin links on their profile pages. Autologin links are of the form:
http://yourwebsite/[subdirectory/]?autologin_code=ABC123
For more convenience it is possible since version 1.05 to generate login links
directly using the wordpress, site-preview functionality. When viewing the page
while being logged in as an administrator, the top-bar will show an extra item
“Auto-login link”. When pointing at the menu item, a dropdown list will list
all users for whom autologin links were generated on their profile pages. When
clicking on one of the users, a popup will open showing the link that will
automatically login a visitor as the selected user and bring him to the
current page.
Security issues
Since autologin links are meant to be an OPEN way to login to
your website and can be viewed by users on their profile, it might be considered
an INSECURE plugin for WordPress. I did my best to make it as secure as possible
to fit my own needs, but this lead to some design choices which might not sit
well with all administrators:
Autologin codes are saved as plain text. This means that anyone who can
execute queries on the WordPress database (plugins, administrators, system
administrators) can obtain the autologin code for a certain user. I planned an
extension of this plugin where login codes are hashed. However, this again has
the disadvantage that noone can redisplay a once generated login link.
This is the most severe problem. For a full self-assesment of possible security
issues regarding this problem, please visit the
plugin website.
