User Switching

説明

このプラグインを利用すると、ボタンをクリックするだけで WordPress のアカウントを切り替えられます。クリックすると直ちにログアウトし、目的のユーザーアカウントでログインし直します。テスト環境や、WooCommerce サイトでのカスタマー支援、異なるアカウントでログイン・ログアウトするテスト環境や、管理者が複数のアカウントを使い分ける必要があるサイトで便利なプラグインです。

機能

  • スイッチユーザー: ユーザー画面で他のユーザーに瞬時に切り替えます。
  • スイッチバック: 元のアカウントに瞬時に戻ります。
  • スイッチオフ: ログアウトしますが、瞬時にログインし直せる状態にしておきます。
  • Compatible with Multisite, WooCommerce, BuddyPress, and bbPress.
  • Compatible with most two-factor authentication solutions (see the FAQ for more info).
  • Approved for use on enterprise-grade WordPress platforms such as Altis and WordPress VIP.

Note: User Switching supports versions of WordPress up to three years old, and PHP version 7.4 or higher.

セキュリティー

  • ユーザーアカウントを切り替えるには、他のユーザー情報の編集権限が必要です。デフォルトでは、シングルサイトの管理者とマルチサイトの特権管理者にこの権限があります。
  • パスワードは表示されません (表示できません)。
  • アカウントを切り替えたり戻ったりする際、WordPress の Cookie 認証システムを使用します。
  • WordPress の nonce セキュリティ システムを実装しているので、切り替えようとしているユーザー以外の第三者が切り替え可能になることはありません。
  • Full support for user session validation where appropriate.
  • Full support for HTTPS.

使い方

  1. WordPress の ユーザーメニューを開くと、各ユーザー名の下のアクションリストの中に切り替えるというリンクがあることがわかります。
  2. このリンクをクリックすると、直ちにそのユーザーアカウントに切り替わります。
  3. ダッシュボード画面や WordPress ツールバーのプロフィールメニューの○○に戻すリンクをクリックすれば、元のアカウントに戻ることができます。

スイッチオフ機能については、よくある質問 を参照してください。

Other Plugins

I maintain several other plugins for developers. Check them out:

  • Query Monitor is the developer tools panel for WordPress
  • WP Crontrol lets you view and control what’s happening in the WP-Cron system

Privacy Statement

User Switching makes use of browser cookies in order to allow users to switch to another account. Its cookies operate using the same mechanism as the authentication cookies in WordPress core, which means their values contain the user’s user_login field in plain text which should be treated as potentially personally identifiable information (PII) for privacy and regulatory reasons (GDPR, CCPA, etc). The names of the cookies are:

  • wordpress_user_sw_{COOKIEHASH}
  • wordpress_user_sw_secure_{COOKIEHASH}
  • wordpress_user_sw_olduser_{COOKIEHASH}

User Switching does not send data to any third party, nor does it include any third party resources, nor will it ever do so.

See also the FAQ for some questions relating to privacy and safety when switching between users.

Accessibility Statement

User Switching aims to be fully accessible to all of its users. It implements best practices for web accessibility, outputs semantic and structured markup, adheres to the default styles and accessibility guidelines of WordPress, uses the accessibility APIs provided by WordPress and web browsers where appropriate, and is fully accessible via keyboard.

User Switching should adhere to Web Content Accessibility Guidelines (WCAG) 2.0 at level AA when used with a recent version of WordPress where its admin area itself adheres to these guidelines. If you’ve experienced or identified an accessibility issue in User Switching, please open a thread in the User Switching plugin support forum and I’ll address it swiftly.

スクリーンショット

  • The Switch To link on the Users screen
  • The Switch To link on a user's profile

FAQ

Does this plugin work with PHP 8?

Yes, it’s actively tested and working up to PHP 8.2.

「スイッチオフ」とはどういう意味ですか。

スイッチオフすると、現在のアカウントからログアウトしますが、ユーザー ID を認証 cookie に保存するので、手動でログインし直さなくてもログイン状態に戻れます。ユーザーを切り替えずに元のユーザーに戻るような動作です。

The Switch Off link can be found in your profile menu in the WordPress toolbar. Once you’ve switched off you’ll see a Switch back link in a few places:

  • In the footer of your site
  • On the Log In screen
  • In the “Meta” widget

このプラグインは WordPress マルチサイトでも動作しますか。

はい。ネットワーク管理者のユーザー画面でユーザーを切り替えることもできます。

Does this plugin work with WooCommerce?

Yes, and you’ll also be able to switch users from various WooCommerce administration screens.

BuddyPress と一緒に使えますか ?

はい。メンバープロフィール画面やメンバーリスト画面でユーザーを切り替えることもできます。

bbPress と一緒に使えますか ?

はい。メンバープロフィール画面でユーザーを切り替えることもできます。

2段階認証プラグインを使用しているサイトでも動作しますか?

はい、ほとんど動作します。

わかっている例外の一つは Duo Security です。このプラグインを使っている場合は、User Switching for Duo Security アドオンをインストールする必要があります。このアドオンは、ユーザー切り替えの際に2段階認証プロンプトが表示されるのを抑止します。

アカウントを切り替えるのに必要な権限は何ですか?

ユーザーアカウントを切り替えるには、edit_users 権限が必要です。デフォルトでは、この権限があるのは管理者だけです。マルチサイトを有効化したサイトでは、特権管理者だけがこの権限を持ちます。

Can the ability to switch accounts be granted to other users or roles?

Yes. The switch_users meta capability can be explicitly granted to a user or a role to allow them to switch users regardless of whether or not they have the edit_users capability. For practical purposes, the user or role will also need the list_users capability so they can access the Users menu in the WordPress admin area.

add_filter( 'user_has_cap', function( $allcaps, $caps, $args, $user ) {
    if ( 'switch_to_user' === $args[0] ) {
        if ( my_condition( $user ) ) {
            $allcaps['switch_users'] = true;
        }
    }
    return $allcaps;
}, 9, 4 );

Note that this needs to happen before User Switching’s own capability filtering, hence the priority of 9.

Can the ability to switch accounts be denied from users?

Yes. User capabilities in WordPress can be set to false to deny them from a user. Denying the switch_users capability prevents the user from switching users, even if they have the edit_users capability.

add_filter( 'user_has_cap', function( $allcaps, $caps, $args, $user ) {
    if ( 'switch_to_user' === $args[0] ) {
        if ( my_condition( $user ) ) {
            $allcaps['switch_users'] = false;
        }
    }
    return $allcaps;
}, 9, 4 );

Note that this needs to happen before User Switching’s own capability filtering, hence the priority of 9.

Can I add a custom “Switch To” link to my own plugin or theme?

Yes. Use the user_switching::maybe_switch_url() method for this. It takes care of authentication and returns a nonce-protected URL for the current user to switch into the provided user account.

if ( method_exists( 'user_switching', 'maybe_switch_url' ) ) {
    $url = user_switching::maybe_switch_url( $target_user );
    if ( $url ) {
        printf(
            '<a href="%1$s">Switch to %2$s</a>',
            esc_url( $url ),
            esc_html( $target_user->display_name )
        );
    }
}

This link also works for switching back to the original user, but if you want an explicit link for this you can use the following code:

if ( method_exists( 'user_switching', 'get_old_user' ) ) {
    $old_user = user_switching::get_old_user();
    if ( $old_user ) {
        printf(
            '<a href="%1$s">Switch back to %2$s</a>',
            esc_url( user_switching::switch_back_url( $old_user ) ),
            esc_html( $old_user->display_name )
        );
    }
}

Can I determine whether the current user switched into their account?

Yes. Use the current_user_switched() function for this. If the current user switched into their account from another then it returns a WP_User object for their originating user, otherwise it returns false.

if ( function_exists( 'current_user_switched' ) ) {
    $switched_user = current_user_switched();
    if ( $switched_user ) {
        // User is logged in and has switched into their account.
        // $switched_user is the WP_User object for their originating user.
    }
}

Does this plugin allow a user to frame another user for an action?

Potentially yes, but User Switching includes some safety protections for this and there are further precautions you can take as a site administrator:

  • User Switching stores the ID of the originating user in the new WordPress user session for the user they switch to. Although this session does not persist by default when they subsequently switch back, there will be a record of this ID if your database server has query logging enabled.
  • User Switching stores the login name of the originating user in an authentication cookie (see the Privacy Statement for more information). If your server access logs store cookie data, there will be a record of this login name (along with the IP address) for each access request.
  • You can install an audit trail plugin such as Simple History, WP Activity Log, or Stream, all of which have built-in support for User Switching and all of which log an entry when a user switches into another account.
  • User Switching triggers an action when a user switches account, switches off, or switches back (see below). You can use these actions to perform additional logging for safety purposes depending on your requirements.

One or more of the above should allow you to correlate an action with the originating user when a user switches account, should you need to.

Bear in mind that even without the User Switching plugin in use, any user who has the ability to edit another user can still frame another user for an action by, for example, changing their password and manually logging into that account. If you are concerned about users abusing others, you should take great care when granting users administrative rights.

マルチサイトを有効にしたサイトで、通常の (特権管理者でない) 管理者はアカウントの切り替えができますか?

いいえ。User Switching for Regular Admins プラグインをインストールすれば可能になります。

Can I switch users directly from the admin toolbar?

Yes, there’s a third party add-on plugin for this: Admin Bar User Switching.

ユーザーがアカウントを切り替えるときに呼び出されるアクションはありますか?

Yes. When a user switches to another account, the switch_to_user hook is called:

/**
 * Fires when a user switches to another user account.
 *
 * @since 0.6.0
 * @since 1.4.0 The `$new_token` and `$old_token` parameters were added.
 *
 * @param int    $user_id     The ID of the user being switched to.
 * @param int    $old_user_id The ID of the user being switched from.
 * @param string $new_token   The token of the session of the user being switched to. Can be an empty string
 *                            or a token for a session that may or may not still be valid.
 * @param string $old_token   The token of the session of the user being switched from.
 */
do_action( 'switch_to_user', $user_id, $old_user_id, $new_token, $old_token );

When a user switches back to their originating account, the switch_back_user hook is called:

/**
 * Fires when a user switches back to their originating account.
 *
 * @since 0.6.0
 * @since 1.4.0 The `$new_token` and `$old_token` parameters were added.
 *
 * @param int       $user_id     The ID of the user being switched back to.
 * @param int|false $old_user_id The ID of the user being switched from, or false if the user is switching back
 *                               after having been switched off.
 * @param string    $new_token   The token of the session of the user being switched to. Can be an empty string
 *                               or a token for a session that may or may not still be valid.
 * @param string    $old_token   The token of the session of the user being switched from.
 */
do_action( 'switch_back_user', $user_id, $old_user_id, $new_token, $old_token );

When a user switches off, the switch_off_user hook is called:

/**
 * Fires when a user switches off.
 *
 * @since 0.6.0
 * @since 1.4.0 The `$old_token` parameter was added.
 *
 * @param int    $old_user_id The ID of the user switching off.
 * @param string $old_token   The token of the session of the user switching off.
 */
do_action( 'switch_off_user', $old_user_id, $old_token );

When a user switches to another account, switches off, or switches back, the user_switching_redirect_to filter is applied to the location that they get redirected to:

/**
 * Filters the redirect location after a user switches to another account or switches off.
 *
 * @since 1.7.0
 *
 * @param string       $redirect_to   The target redirect location, or an empty string if none is specified.
 * @param string|null  $redirect_type The redirect type, see the `user_switching::REDIRECT_*` constants.
 * @param WP_User|null $new_user      The user being switched to, or null if there is none.
 * @param WP_User|null $old_user      The user being switched from, or null if there is none.
 */
return apply_filters( 'user_switching_redirect_to', $redirect_to, $redirect_type, $new_user, $old_user );

In addition, User Switching respects the following filters from WordPress core when appropriate:

  • login_redirect when switching to another user.
  • logout_redirect when switching off.

Do you accept donations?

I am accepting sponsorships via the GitHub Sponsors program and any support you can give will help me maintain this plugin and keep it free for everyone.

評価

2023年11月14日
I was previously using a plugin from codecanyon for years. Suddenly it had some weird issue where it was not playing nicely with other plugins, and I had to ditch it. Found this plugin and love it! My only suggestion would be to consider adding some CSS to the front end "switch" box, so its more obvious. I personally came up with this code to add into my theme for now. /*** SWITCH USER ***/p#user_switching_switch_on {background-color: #efefef;padding: 10px 25px !important;border: solid grey 3px;font-weight: bold;text-transform: uppercase;}
2023年7月12日 2 replies
This is an excellent tool, thank you so much to the developer for their contribution. I hope to see some updates soon. Worrying that it might be abandoned as it hasn't received any updates for almost a year.
2023年6月6日
I am really grateful that this tool exists, it works flawlessly.
216件のレビューをすべて表示

貢献者と開発者

User Switching はオープンソースソフトウェアです。以下の人々がこのプラグインに貢献しています。

貢献者

“User Switching” は48ロケールに翻訳されています。 翻訳者のみなさん、翻訳へのご協力ありがとうございます。

“User Switching” をあなたの言語に翻訳しましょう。

開発に興味がありますか ?

コードを閲覧するか、SVN リポジトリをチェックするか、開発ログRSS で購読してみてください。

変更履歴

1.7.2 (16 November 2023)

  • Confirm support for WordPress 6.4
  • Reinstate the missing plugin readme file

1.7.1 (16 November 2023)

  • Fix the redirect type parameter passed to the user_switching_redirect_to filter
  • Increase the minimum supported version of PHP to 7.4

1.7.0 (30 July 2022)

  • Redirect to the current post, term, user, or comment being edited when switching off
  • Clean up some user-facing messages
  • Apply basic styling to the Switch Back link that appears in the footer
  • Use a better placement for the Switch To menu on bbPress profiles
  • Use a more appropriate HTTP response code if switching off fails
  • Exclude .editorconfig from dist ZIP

1.6.0 (24 June 2022)

  • Add a ‘Switch To’ link to the order screen in WooCommerce
  • Add a ‘Switch back’ link to the My Account screen and the login screen in WooCommerce

1.5.8 (2 October 2021)

  • Avoid a fatal if the interim-login query parameter is present on a page other than wp-login.php.

1.5.7 (12 May 2021)

  • Fix some issues that could lead to PHP errors given a malformed cookie.
  • Fix documentation.

1.5.6 (18 September 2020)

  • Add a class to the table row on the user edit screen.
  • Updated docs.

1.5.5 (22 June 2020)

  • Added the user_switching_in_footer filter to disable output in footer on front end.
  • Documentation additions and improvements.

1.5.4 (7 February 2020)

  • Fix a cookie issue caused by Jetpack 8.1.1 which prevented switching back to the original user.

1.5.3 (5 November 2019)

  • Remove usage of a method that’s been deprecated in WordPress 5.3

1.5.2 (16 August 2019)

  • Set the correct lang attribute on User Switching’s admin notice.
  • Move the WooCommerce session forgetting to an action callback so it can be unhooked if necessary.

1.5.1 (16 June 2019)

  • Add appropriate HTTP response codes to the error states.
  • Display User Switching’s messages in the original user’s locale.
  • Increase the priority of the hook that sets up the cookie constants. See #40.
  • Don’t attempt to output the ‘Switch To’ link on author archives when the queried object isn’t a user. See #39.

1.5.0 (23 March 2019)

  • Add support for forgetting WooCommerce sessions when switching between users. Requires WooCommerce 3.6+.

1.4.2 (13 February 2019)

  • Don’t attempt to add the Switch To link to the admin toolbar when viewing an author archive in the admin area. This prevents a fatal error occurring when filtering custom post type listing screens by authors in the admin area.

1.4.1 (2 February 2019)

  • Add a Switch To link to the Edit User admin toolbar menu when viewing an author archive.
  • Add a Switch back link to the Edit User admin toolbar menu when viewing an author archive and you’re already switched.

1.4.0 (17 September 2018)

  • Add support for user session retention, reuse, and destruction when switching to and back from other user accounts.
  • Add support for the switch_users meta capability for fine grained control over the ability to switch user accounts.
  • More code and documentation quality improvements.

1.3.1 (24 May 2018)

  • Add support for the X-Redirect-By header in WordPress 5.0.
  • Allow User Switching’s admin notices to be dismissed.
  • Introduce a privacy statement.

1.3.0 (9 November 2017)

  • Update the BuddyPress compatibility.
  • Various code and inline docs improvements.

1.2.0 (29 September 2017)

  • Improve the Switch Back functionality when the interim login window is shown.
  • Always show the Switch Back link in the Meta widget if it’s present.

1.1.0 (7 September 2017)

  • Introduce a user_switching_switched_message filter to allow customisation of the message displayed to switched users in the admin area.
  • Switch to safe redirects for extra paranoid hardening.
  • Docblock improvements.
  • Coding standards improvements.

1.0.9 (14 July 2016)

  • Remove the bundled languages in favour of language packs from translate.wordpress.org.

1.0.8 (14 July 2016)

  • Chinese (Taiwan) and Czech translations.
  • Updated Dutch, Spanish, Hebrew, and German translations.
  • Add an ID attribute to the links that User Switching outputs on the WordPress login screen, BuddyPress screens, and bbPress screens.
  • Avoid a deprecated argument notice when the user-actions admin toolbar node has been removed.

1.0.7 (14 July 2016)

  • Azerbaijani, Danish, and Bosnian translations.
  • Add back the ‘User Switching’ heading on the user profile screen.
  • Correct the value passed to the $old_user_id parameter of the switch_back_user hook when a user has been switched off. This should be boolean false rather than 0.
  • Docblocks for actions and filters.
  • コードスタンダードの追加修正。

1.0.6 (14 July 2016)

  • Correct the values passed to the switch_back_user action when a user switches back.
  • コードスタンダードの追加修正。

1.0.5 (14 July 2016)

  • Norwegian translation by Per Søderlind.
  • コードスタンダードの修正。

1.0.4 (14 July 2016)

  • Support for the new logout_redirect and removable_query_args filters in WordPress 4.2.

1.0.3 (14 July 2016)

  • Ante Sepic によるクロアチア語の翻訳。
  • Avoid PHP notices caused by other plugins which erroneously use boolean true as a capability.

1.0.2 (14 July 2016)

  • Turkish translation by Abdullah Pazarbasi.
  • ArianServ によるルーマニア語翻訳。
  • Thom によるオランダ語翻訳。
  • evigiannakou によるギリシャ語翻訳。
  • Bulgarian translation by Petya Raykovska.
  • Finnish translation by Sami Keijonen.
  • Italian translation by Alessandro Curci and Alessandro Tesoro.
  • Updated Arabic, Spanish, German, and Polish translations.

1.0.1 (14 July 2016)

  • Shorten the names of User Switching’s cookies to avoid problems with Suhosin’s over-zealous default rules.
  • Add backwards compatibility for the deprecated OLDUSER_COOKIE constant.

1.0 (14 July 2016)

  • Security hardening for sites that use HTTPS in the admin area and HTTP on the front end.
  • Add an extra auth check before the nonce verification.
  • Pretty icon next to the switch back links.