• Resolved walid91

    (@walid91)


    Hi,

    I’m facing a serious security problem.

    For the moment, I have not installed your plugin on my main site, but on a staging site.

    I installed the “WPS Hide Login” plugin to hide the WordPress login page.

    Look here: https://ibb.co/JBGHxGf

    On the “my account” page where the login button is, when I click on “inspect” the login URL appears.

    Look here: https://ibb.co/02ZHskd

    This is a very big problem.

    What is the solution for this?

    Thank you.

Viewing 9 replies - 1 through 9 (of 9 total)
  • Ramona

    (@nextend_ramona)

    Hi @walid91

    By default Nextend Social Login uses the /wp-login.php (or its equal) to handle the login and registration flow.

    When the wp-login.php page isn’t accessible or you don’t want that to be used for the login and registration flow then you need to create custom pages for Nextend Social Login to handle the login flow.

    First create an empty page what you will not use for anything else, then at Global Settings -> General tab:
    https://nextendweb.com/nextend-social-login-docs/global-settings/
    you should use the “OAuth redirect uri proxy page” setting. This means that our plugin will no longer use the /wp-login.php page for the API connection, but the custom page you created and selected here. At your API settings you made, for example at Facebook:
    https://nextendweb.com/nextend-social-login-docs/provider-facebook/#configuration
    you have to change the step 12. setting, to change the URL for the API. This also changes the URL on the social login button.

    Then create another new page again, and also at the Global settings:
    https://nextendweb.com/nextend-social-login-docs/global-settings/
    you will find a “Page for register flow” setting. To the new page’s description you should add the given shortcode, [nextend_social_login_register_flow]. Then select that page with our settings. This page will be used to ask “custom data”, such as an email address from the users who register with Nextend Social Login.

    Thread Starter walid91

    (@walid91)

    Hi,

    Thank you for your quick response.

    There are a lot of changes to make, I’ll keep you informed.

    Ramona

    (@nextend_ramona)

    Hi,

    I just noticed that the login button is probably custom made (e.g. a theme’s custom integration) so they probably hard-coded the URL which we can’t change automatically. So there’s a chance that you’ll manually need to update the login button URL to use the “OAuth redirect uri proxy page” link. We can only update those buttons, that we create but based on your screenshots I think we don’t actually create these buttons but a 3rd party does.

    If the integration is made by your theme, I recommend contacting the theme developers to learn the best way to replace their custom buttons. You might also bring it to their attention that we have a PHP code for publishing the buttons:
    https://nextendweb.com/nextend-social-login-docs/theme-developer/
    If they use that, then the login buttons will be created by us and all of our options will work with the buttons without having to make changes to the theme (or their Nextend Social Login integration).

    This change on their end would also be important because some providers have strict design guidelines, like Facebook does:
    https://nextendweb.com/nextend-social-login-docs/provider-facebook/#guidelines
    and if the button you’re using doesn’t meet their guideline they can shut down your app without any further notice and won’t enable it again until their guidelines are met.

    Thread Starter walid91

    (@walid91)

    Hi,

    I followed the steps as you explained.

    The plugin works, but the problem is still the same, the login page I modified with the “WPS Hide Login” plugin is still visible.

    Maybe I expressed myself wrong.

    Concerning your second post, indeed this button comes from my porto theme.

    I just realized it by translating the button.

    Ramona

    (@nextend_ramona)

    Hi @walid91

    In that case they’ve probady did a hard-coded integration, which means that you need to find the place (the .php file) where they added our login buttons to their theme and modify it there to use the new URL.

    I’m not really familiar with Porto theme, so the best guide I could give is to search through its files, as you can see here:
    https://smartslider.helpscoutdocs.com/article/1935-troubleshooting-with-your-browser#search
    and try to find the loginFacebook=1 there and replace the URL they gave there to your current one.

    Alternatively, you could replace their entire custom integration with our PHP code:
    https://nextendweb.com/nextend-social-login-docs/theme-developer/
    so our code would display the buttons and would take care of the OAuth page changes.

    You might also contact your theme developers and suggest them to rather use the PHP code integration method to ensure the best compatibility with both our options and the provider guidelines.

    Thread Starter walid91

    (@walid91)

    Hi,

    Indeed, now, using your widget, the login page is not visible anymore and that’s the most important.

    I will try to see about the button in my theme, but it is now a secondary thing.

    Thank you for your quick and clear help.

    Thread Starter walid91

    (@walid91)

    Hi,

    I found the “loginFacebook=1” in the folder porto\woocommerce\myaccount\form-login.php

    Look here : https://ibb.co/27wMCyT

    But I didn’t understand the way to

    replace the URL they gave there to your current one

    If you can enlighten me.

    Thank you.

    • This reply was modified 2 years, 4 months ago by walid91.
    Ramona

    (@nextend_ramona)

    Hi @walid91

    If you want to use their buttons:
    You should remove the following code:
    <?php echo wp_login_url(); ?>
    and put the link of the “OAuth redirect uri proxy page” link in its place. You’ll need to manually update this link in case you change the “OAuth redirect uri proxy page” in the future.

    If you want to use our buttons:
    You should remove everything starting from line 40 and ending at line 50. (Including the content in line 50.) Then put our PHP code:
    https://nextendweb.com/nextend-social-login-docs/theme-developer/
    in line 40 instead.

    Thread Starter walid91

    (@walid91)

    Hi,

    Your advice was very helpful and everything worked perfectly.

    Thanks again for your help.

Viewing 9 replies - 1 through 9 (of 9 total)
  • The topic ‘Login URL appears’ is closed to new replies.