Temporary Document Access

Temporary Document Access is a WordPress plugin that adds a private Documents section and allows administrators to generate temporary access links for individual documents.

Each generated link contains a document ID, a token, and an expiration timestamp. The link is valid for 1 hour and can be used to view the document only while the token and expiration timestamp are valid.

Features

• Registers a private custom post type: shared_document.
• Supports only the document title and editor fields.
• Keeps documents hidden from public archives, search, and regular frontend URLs.
• Adds an Access Management metabox to the document editor.
• Generates temporary access links in the format:

https://example.com/?view_doc=[ID]&token=[HASH]&expires=[TIMESTAMP]

• Saves the generated URL, token, and expiration timestamp in post meta.
• Displays the latest generated link in the admin area for copying.
• Validates access by checking:
  • the document ID;
  • the expiration timestamp;
  • the token generated from the document ID, expiration timestamp, and wp_salt();
  • the latest saved token and expiration timestamp.
• Shows the document through a dedicated template only when validation succeeds.
• Returns a 403 error when the link is invalid or expired.

Requirements

• WordPress 6.x or newer.
• PHP 8.2 or newer.

Installation

1. Copy the plugin folder to:

wp-content/plugins/temporary-document-access-plugin/

2. Go to WordPress Admin → Plugins.
3. Activate Temporary Document Access.
4. Open Documents in the admin menu.
5. Create or edit a document.
6. Click Generate Link in the Access Management metabox.
7. Copy the generated temporary link.

How It Works

The plugin registers a non-public custom post type called shared_document. Documents cannot be accessed through normal WordPress URLs because the post type is registered with:

'public' => false,
'has_archive' => false,
'publicly_queryable' => false,

Temporary access works through a custom query URL:

/?view_doc=[ID]&token=[HASH]&expires=[TIMESTAMP]

When a visitor opens this URL, the plugin:

1. Reads and sanitizes the request parameters.
2. Checks that the expiration timestamp has not passed.
3. Recalculates the token using the document ID, expiration timestamp, and wp_salt().
4. Compares the provided token with the expected token using hash_equals().
5. Compares the provided token and expiration timestamp with the latest saved values in post meta.
6. Loads the document template if validation passes.
7. Stops the request with a 403 error if validation fails.

Project Structure

temporary-document-access-plugin/
├── temporary-document-access.php
├── includes/
│   ├── class-plugin.php
│   ├── class-post-type.php
│   ├── class-admin.php
│   ├── class-token-service.php
│   └── class-frontend.php
├── templates/
│   └── document-view.php
└── README.md

Security Notes

• Admin link generation uses a nonce-protected POST request through admin-post.php.
• The plugin checks user permissions with current_user_can('edit_post', $post_id) before generating a link.
• Request parameters are sanitized with WordPress helpers such as absint(), sanitize_text_field(), and wp_unslash().
• Output is escaped with functions such as esc_url(), esc_attr(), and esc_html__().
• Token comparison uses hash_equals().
• The generated link is valid for 1 hour.
• Only the latest generated link remains valid for a document.