Login with GET Parameters

[ANGDIC]

HI,

does anyone know how to login via GET  variables in url skipping the login page?

Thank you so much?

[alec]

You can write a simple plugin.

[ANGDIC]

Can you give me an example?

[SKaero]

Here an auto login plugin http://trac.roundcube.net/browser/trunk/plugins/autologon/autologon.php you could modify it to login with url variables.

[corbosman]

You really dont want to use GET for that. That would expose the password to possible third parties like proxies and also to logfiles.

[ANGDIC]

class myautologin extends rcube_plugin
{
  public $task = 'login';
 
  function init()
  {
   $this->add_hook('startup', array($this, 'startup'));
    $this->add_hook('authenticate', array($this, 'authenticate'));
  }
 
  function startup($args)
     {
       $rcmail = rcmail::get_instance();
   
       // change action to login
       if (empty($_SESSION['user_id']) && !empty($_GET['_autologin']))
         $args['action'] = 'login';
   
       return $args;
     }
 
  function authenticate($args)
  {
   if (!empty($_GET['_user']) && $this->is_localhost()) {
         $args['user'] = $_GET['_user'];
         $args['pass'] = $_GET['_pass'];
    $args['valid'] = true;
   
    return $args;
    }
  }
}

Where are errors?
thks

[ANGDIC]

class myautologin extends rcube_plugin
{
  public $task = 'login';
 
  function init()
  {
   $this->add_hook('startup', array($this, 'startup'));
    $this->add_hook('authenticate', array($this, 'authenticate'));
  }
 
  function startup($args)
     {
       $rcmail = rcmail::get_instance();
   
       // change action to login
       if (empty($_SESSION['user_id']) && !empty($_GET['_user']))
         $args['action'] = 'login';
   
       return $args;
     }
 
  function authenticate($args)
  {
   if (!empty($_GET['_user'])) {
         $args['user'] = $_GET['_user'];
         $args['pass'] = $_GET['_pass'];
    $args['valid'] = true;
   
    return $args;
    }
  }
}

[rosali]

Just a side note:

Use ...


get_input_value('_user', RCUBE_INPUT_GPC)


... Dev_PHPCommons ? Roundcube Webmail ...

Please consider comment by Cor Bosman. You should never use GET params
unless you are on a INTRANET. Using get to transmit Login credentials opens
all backdoors.