Edit: sso.php

<?php
/**
 * Plugin Name: SSO
 * Author: Garth Mortensen, Mike Hansen
 * Version: 0.4
 * License: GPLv2 or later
 * License URI: http://www.gnu.org/licenses/gpl-2.0.html
 */

function sso_check()
{
    if (!isset($_GET['salt']) || !isset($_GET['nonce'])) {
        sso_req_login();
    }
    if (sso_check_blocked()) {
        sso_req_login();
    }

$nonce = esc_attr($_GET['nonce']);
    $salt = esc_attr($_GET['salt']);

if (!empty($_GET['user'])) {
        $user = esc_attr($_GET['user']);
    } else {
        $user = get_users(array('role' => 'administrator', 'number' => 1));
        if (is_array($user) && is_a($user[0], 'WP_User')) {
            $user = $user[0];
            $user = $user->ID;
        } else {
            $user = 0;
        }
    }

$bounce = !empty($_GET['bounce']) ? $_GET['bounce'] : '';
    $hash = base64_encode(hash('sha256', $nonce . $salt, false));
    $hash = substr($hash, 0, 64);

if (get_transient('sso_token') == $hash) {
        if (is_email($user)) {
            $user = get_user_by('email', $user);
        } else {
            $user = get_user_by('id', (int)$user);
        }
        if (is_a($user, 'WP_User')) {
            wp_set_current_user($user->ID, $user->user_login);
            wp_set_auth_cookie($user->ID);
            do_action('wp_login', $user->user_login, $user);
            delete_transient('sso_token');
            wp_safe_redirect(admin_url($bounce));
        } else {
            sso_req_login();
        }
    } else {
        sso_add_failed_attempt();
        sso_req_login();
    }
    die();
}

sso_check_attempt();

function sso_req_login()
{
    wp_safe_redirect(wp_login_url());
}

function sso_get_attempt_id()
{
    return 'sso' . esc_url($_SERVER['REMOTE_ADDR']);
}

function sso_add_failed_attempt()
{
    $attempts = get_transient(sso_get_attempt_id(), 0);
    $attempts++;
    set_transient(sso_get_attempt_id(), $attempts, 300);
}

function sso_check_blocked()
{
    $attempts = get_transient(sso_get_attempt_id(), 0);
    if ($attempts > 4) {
        return true;
    }

return false;
}

Cancel