=== Dalmatian Dream Login As User ===
Contributors: Boris Horvat
Tags: users, login, admin, impersonation, user switching
Requires at least: 6.5
Tested up to: 7.0
Requires PHP: 8.1
Stable tag: 2.0.6
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Securely allows trusted administrators to log in as another user and return to their administrator account.

== Description ==

Dalmatian Dream Login As User adds a secure "Login as user" action to the WordPress Users screen for administrators with the dedicated `dd_switch_users` capability.

Version 2.0.6 uses opaque per-session switch tokens, server-side transient state, nonce-protected switch and return actions, strict target validation, safe redirects, and cleanup on logout. It blocks nested impersonation and protects multisite super administrator accounts.

== Installation ==

1. Upload the `dd-login-as-user` folder to `/wp-content/plugins/`.
2. Activate the plugin through the Plugins screen in WordPress.
3. Administrators receive the `dd_switch_users` capability on activation.

== Frequently Asked Questions ==

= Who can switch users? =

Only users with the `dd_switch_users` capability can start a switch session. The plugin adds that capability to the administrator role on activation.

= Can administrators impersonate other administrators? =

On single-site installs, administrator-to-administrator switching is blocked by default. Developers can opt in with the `dd_login_as_user_allow_admin_target` filter.

= How long does a switch session last? =

The default timeout is 60 minutes. It can be adjusted with the `DD_LOGIN_AS_USER_TIMEOUT` constant or the `dd_login_as_user_timeout` filter.

== Changelog ==

= 2.0.6 =
* Added the plugin languages folder.
* Documented the intentional WordPress core login hook call for compatibility.

= 2.0.5 =
* Restored the impersonated account early from the secure switch token when the WordPress auth cookie is not accepted.
* Fired the standard WordPress login action after a successful switch.

= 2.0.4 =
* Changed successful switch landing to the admin dashboard instead of the user profile screen.
* Prevented cached profile redirects from blocking impersonation when profile access is hidden.
* Set a persistent authentication cookie for the impersonated account.

= 2.0.3 =
* Fixed Plugin Check internationalization and redirect sanitization findings.
* Removed discouraged manual translation loading call.

= 2.0.2 =
* Changed successful switch redirect to the impersonated user's profile panel.

= 2.0.1 =
* Fixed blank page after switching to another user.
* Fixed blank page after returning to the administrator account.
* Improved safe local redirect handling after account switches.

= 2.0.0 =
* Reworked user impersonation session security.
* Added unique switch-session tokens.
* Added secure return-to-administrator workflow.
* Added dedicated switch capability.
* Added multisite and administrator-target protections.
* Improved nonce, input sanitization and redirect handling.
* Added internationalization support.
* Removed production debug output.
* Added lightweight audit hooks.
* Improved WordPress.org / Plugin Check compatibility.
