diff -r c7c34916027a -r 177826044cd9 wp/wp-login.php
--- a/wp/wp-login.php Mon Oct 14 18:06:33 2019 +0200
+++ b/wp/wp-login.php Mon Oct 14 18:28:13 2019 +0200
@@ -9,11 +9,11 @@
*/
/** Make sure that the WordPress bootstrap has run before continuing. */
-require( dirname(__FILE__) . '/wp-load.php' );
+require( dirname( __FILE__ ) . '/wp-load.php' );
-// Redirect to https login if forced to use SSL
+// Redirect to HTTPS login if forced to use SSL.
if ( force_ssl_admin() && ! is_ssl() ) {
- if ( 0 === strpos($_SERVER['REQUEST_URI'], 'http') ) {
+ if ( 0 === strpos( $_SERVER['REQUEST_URI'], 'http' ) ) {
wp_safe_redirect( set_url_scheme( $_SERVER['REQUEST_URI'], 'https' ) );
exit();
} else {
@@ -25,6 +25,8 @@
/**
* Output the login page header.
*
+ * @since 2.1.0
+ *
* @param string $title Optional. WordPress login Page title to display in the `` element.
* Default 'Log In'.
* @param string $message Optional. Message to display in header. Default empty.
@@ -34,7 +36,7 @@
global $error, $interim_login, $action;
// Don't index any of these forms
- add_action( 'login_head', 'wp_no_robots' );
+ add_action( 'login_head', 'wp_sensitive_page_meta' );
add_action( 'login_head', 'wp_login_viewport_meta' );
@@ -53,14 +55,20 @@
*/
$shake_error_codes = apply_filters( 'shake_error_codes', $shake_error_codes );
- if ( $shake_error_codes && $wp_error->get_error_code() && in_array( $wp_error->get_error_code(), $shake_error_codes ) )
+ if ( $shake_error_codes && $wp_error->has_errors() && in_array( $wp_error->get_error_code(), $shake_error_codes ) ) {
add_action( 'login_head', 'wp_shake_js', 12 );
+ }
$login_title = get_bloginfo( 'name', 'display' );
/* translators: Login screen title. 1: Login screen name, 2: Network or site name */
$login_title = sprintf( __( '%1$s ‹ %2$s — WordPress' ), $title, $login_title );
+ if ( wp_is_recovery_mode() ) {
+ /* translators: %s: Login screen title. */
+ $login_title = sprintf( __( 'Recovery Mode — %s' ), $login_title );
+ }
+
/**
* Filters the title tag content for login page.
*
@@ -79,7 +87,7 @@
<html xmlns="http://www.w3.org/1999/xhtml" <?php language_attributes(); ?>>
<!--<![endif]-->
<head>
- <meta http-equiv="Content-Type" content="<?php bloginfo('html_type'); ?>; charset=<?php bloginfo('charset'); ?>" />
+ <meta http-equiv="Content-Type" content="<?php bloginfo( 'html_type' ); ?>; charset=<?php bloginfo( 'charset' ); ?>" />
<title><?php echo $login_title; ?>
get_error_code() ) {
?>
@@ -110,13 +118,7 @@
*/
do_action( 'login_head' );
- if ( is_multisite() ) {
- $login_header_url = network_home_url();
- $login_header_title = get_network()->site_name;
- } else {
- $login_header_url = __( 'https://wordpress.org/' );
- $login_header_title = __( 'Powered by WordPress' );
- }
+ $login_header_url = __( 'https://wordpress.org/' );
/**
* Filters link URL of the header logo above login form.
@@ -127,38 +129,50 @@
*/
$login_header_url = apply_filters( 'login_headerurl', $login_header_url );
+ $login_header_title = '';
+
/**
* Filters the title attribute of the header logo above login form.
*
* @since 2.1.0
+ * @deprecated 5.2.0 Use login_headertext
*
* @param string $login_header_title Login header logo title attribute.
*/
- $login_header_title = apply_filters( 'login_headertitle', $login_header_title );
+ $login_header_title = apply_filters_deprecated(
+ 'login_headertitle',
+ array( $login_header_title ),
+ '5.2.0',
+ 'login_headertext',
+ __( 'Usage of the title attribute on the login logo is not recommended for accessibility reasons. Use the link text instead.' )
+ );
- /*
- * To match the URL/title set above, Multisite sites have the blog name,
- * while single sites get the header title.
+ $login_header_text = empty( $login_header_title ) ? __( 'Powered by WordPress' ) : $login_header_title;
+
+ /**
+ * Filters the link text of the header logo above the login form.
+ *
+ * @since 5.2.0
+ *
+ * @param string $login_header_text The login header logo link text.
*/
- if ( is_multisite() ) {
- $login_header_text = get_bloginfo( 'name', 'display' );
- } else {
- $login_header_text = $login_header_title;
- }
+ $login_header_text = apply_filters( 'login_headertext', $login_header_text );
$classes = array( 'login-action-' . $action, 'wp-core-ui' );
- if ( is_rtl() )
+ if ( is_rtl() ) {
$classes[] = 'rtl';
+ }
if ( $interim_login ) {
$classes[] = 'interim-login';
?>
-
+
add('error', $error);
- unset($error);
}
- if ( $wp_error->get_error_code() ) {
- $errors = '';
+ // In case a plugin uses $error rather than the $wp_errors object.
+ if ( ! empty( $error ) ) {
+ $wp_error->add( 'error', $error );
+ unset( $error );
+ }
+
+ if ( $wp_error->has_errors() ) {
+ $errors = '';
$messages = '';
foreach ( $wp_error->get_error_codes() as $code ) {
$severity = $wp_error->get_error_data( $code );
foreach ( $wp_error->get_error_messages( $code ) as $error_message ) {
- if ( 'message' == $severity )
+ if ( 'message' == $severity ) {
$messages .= ' ' . $error_message . "
\n";
- else
+ } else {
$errors .= ' ' . $error_message . "
\n";
+ }
}
}
if ( ! empty( $errors ) ) {
@@ -242,23 +255,28 @@
/**
* Outputs the footer for the login page.
*
- * @param string $input_id Which input to auto-focus
+ * @since 3.1.0
+ *
+ * @param string $input_id Which input to auto-focus.
*/
-function login_footer($input_id = '') {
+function login_footer( $input_id = '' ) {
global $interim_login;
// Don't allow interim logins to navigate away from the page.
- if ( ! $interim_login ): ?>
-
+
+
- ', '
\n" . __('Possible reason: your host may have disabled the mail() function.') );
+ if ( $message && ! wp_mail( $user_email, wp_specialchars_decode( $title ), $message ) ) {
+ wp_die( __( 'The email could not be sent. Possible reason: your host may have disabled the mail() function.' ) );
+ }
return true;
}
//
-// Main
+// Main.
//
-$action = isset($_REQUEST['action']) ? $_REQUEST['action'] : 'login';
+$action = isset( $_REQUEST['action'] ) ? $_REQUEST['action'] : 'login';
$errors = new WP_Error();
-if ( isset($_GET['key']) )
+if ( isset( $_GET['key'] ) ) {
$action = 'resetpass';
+}
-// validate action so as to default to the login screen
-if ( !in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'confirmaction' ), true ) && false === has_filter( 'login_form_' . $action ) )
+// Validate action so as to default to the login screen.
+if ( ! in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'confirmaction', WP_Recovery_Mode_Link_Service::LOGIN_ACTION_ENTERED ), true ) && false === has_filter( 'login_form_' . $action ) ) {
$action = 'login';
+}
nocache_headers();
-header('Content-Type: '.get_bloginfo('html_type').'; charset='.get_bloginfo('charset'));
+header( 'Content-Type: ' . get_bloginfo( 'html_type' ) . '; charset=' . get_bloginfo( 'charset' ) );
if ( defined( 'RELOCATE' ) && RELOCATE ) { // Move flag is set
- if ( isset( $_SERVER['PATH_INFO'] ) && ($_SERVER['PATH_INFO'] != $_SERVER['PHP_SELF']) )
+ if ( isset( $_SERVER['PATH_INFO'] ) && ( $_SERVER['PATH_INFO'] != $_SERVER['PHP_SELF'] ) ) {
$_SERVER['PHP_SELF'] = str_replace( $_SERVER['PATH_INFO'], '', $_SERVER['PHP_SELF'] );
+ }
- $url = dirname( set_url_scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] ) );
- if ( $url != get_option( 'siteurl' ) )
+ $url = dirname( set_url_scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] ) );
+ if ( $url != get_option( 'siteurl' ) ) {
update_option( 'siteurl', $url );
+ }
}
//Set a cookie now to see if they are supported by the browser.
$secure = ( 'https' === parse_url( wp_login_url(), PHP_URL_SCHEME ) );
setcookie( TEST_COOKIE, 'WP Cookie check', 0, COOKIEPATH, COOKIE_DOMAIN, $secure );
-if ( SITECOOKIEPATH != COOKIEPATH )
+if ( SITECOOKIEPATH != COOKIEPATH ) {
setcookie( TEST_COOKIE, 'WP Cookie check', 0, SITECOOKIEPATH, COOKIE_DOMAIN, $secure );
-
-$lang = ! empty( $_GET['wp_lang'] ) ? sanitize_text_field( $_GET['wp_lang'] ) : '';
-$switched_locale = switch_to_locale( $lang );
+}
/**
* Fires when the login form is initialized.
@@ -458,8 +488,8 @@
*/
do_action( "login_form_{$action}" );
-$http_post = ('POST' == $_SERVER['REQUEST_METHOD']);
-$interim_login = isset($_REQUEST['interim-login']);
+$http_post = ( 'POST' == $_SERVER['REQUEST_METHOD'] );
+$interim_login = isset( $_REQUEST['interim-login'] );
/**
* Filters the separator used between login form navigation links.
@@ -470,233 +500,227 @@
*/
$login_link_separator = apply_filters( 'login_link_separator', ' | ' );
-switch ($action) {
-
-case 'postpass' :
- if ( ! array_key_exists( 'post_password', $_POST ) ) {
- wp_safe_redirect( wp_get_referer() );
- exit();
- }
-
- require_once ABSPATH . WPINC . '/class-phpass.php';
- $hasher = new PasswordHash( 8, true );
-
- /**
- * Filters the life span of the post password cookie.
- *
- * By default, the cookie expires 10 days from creation. To turn this
- * into a session cookie, return 0.
- *
- * @since 3.7.0
- *
- * @param int $expires The expiry time, as passed to setcookie().
- */
- $expire = apply_filters( 'post_password_expires', time() + 10 * DAY_IN_SECONDS );
- $referer = wp_get_referer();
- if ( $referer ) {
- $secure = ( 'https' === parse_url( $referer, PHP_URL_SCHEME ) );
- } else {
- $secure = false;
- }
- setcookie( 'wp-postpass_' . COOKIEHASH, $hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ), $expire, COOKIEPATH, COOKIE_DOMAIN, $secure );
-
- if ( $switched_locale ) {
- restore_previous_locale();
- }
-
- wp_safe_redirect( wp_get_referer() );
- exit();
+switch ( $action ) {
-case 'logout' :
- check_admin_referer('log-out');
-
- $user = wp_get_current_user();
-
- wp_logout();
-
- if ( ! empty( $_REQUEST['redirect_to'] ) ) {
- $redirect_to = $requested_redirect_to = $_REQUEST['redirect_to'];
- } else {
- $redirect_to = 'wp-login.php?loggedout=true';
- $requested_redirect_to = '';
- }
-
- if ( $switched_locale ) {
- restore_previous_locale();
- }
-
- /**
- * Filters the log out redirect URL.
- *
- * @since 4.2.0
- *
- * @param string $redirect_to The redirect destination URL.
- * @param string $requested_redirect_to The requested redirect destination URL passed as a parameter.
- * @param WP_User $user The WP_User object for the user that's logging out.
- */
- $redirect_to = apply_filters( 'logout_redirect', $redirect_to, $requested_redirect_to, $user );
- wp_safe_redirect( $redirect_to );
- exit();
-
-case 'lostpassword' :
-case 'retrievepassword' :
-
- if ( $http_post ) {
- $errors = retrieve_password();
- if ( !is_wp_error($errors) ) {
- $redirect_to = !empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : 'wp-login.php?checkemail=confirm';
- wp_safe_redirect( $redirect_to );
+ case 'postpass':
+ if ( ! array_key_exists( 'post_password', $_POST ) ) {
+ wp_safe_redirect( wp_get_referer() );
exit();
}
- }
+
+ require_once ABSPATH . WPINC . '/class-phpass.php';
+ $hasher = new PasswordHash( 8, true );
- if ( isset( $_GET['error'] ) ) {
- if ( 'invalidkey' == $_GET['error'] ) {
- $errors->add( 'invalidkey', __( 'Your password reset link appears to be invalid. Please request a new link below.' ) );
- } elseif ( 'expiredkey' == $_GET['error'] ) {
- $errors->add( 'expiredkey', __( 'Your password reset link has expired. Please request a new link below.' ) );
+ /**
+ * Filters the life span of the post password cookie.
+ *
+ * By default, the cookie expires 10 days from creation. To turn this
+ * into a session cookie, return 0.
+ *
+ * @since 3.7.0
+ *
+ * @param int $expires The expiry time, as passed to setcookie().
+ */
+ $expire = apply_filters( 'post_password_expires', time() + 10 * DAY_IN_SECONDS );
+ $referer = wp_get_referer();
+ if ( $referer ) {
+ $secure = ( 'https' === parse_url( $referer, PHP_URL_SCHEME ) );
+ } else {
+ $secure = false;
}
- }
+ setcookie( 'wp-postpass_' . COOKIEHASH, $hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ), $expire, COOKIEPATH, COOKIE_DOMAIN, $secure );
+
+ wp_safe_redirect( wp_get_referer() );
+ exit();
+
+ case 'logout':
+ check_admin_referer( 'log-out' );
+
+ $user = wp_get_current_user();
+
+ wp_logout();
+
+ if ( ! empty( $_REQUEST['redirect_to'] ) ) {
+ $redirect_to = $requested_redirect_to = $_REQUEST['redirect_to'];
+ } else {
+ $redirect_to = 'wp-login.php?loggedout=true';
+ $requested_redirect_to = '';
+ }
- $lostpassword_redirect = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
- /**
- * Filters the URL redirected to after submitting the lostpassword/retrievepassword form.
- *
- * @since 3.0.0
- *
- * @param string $lostpassword_redirect The redirect destination URL.
- */
- $redirect_to = apply_filters( 'lostpassword_redirect', $lostpassword_redirect );
+ /**
+ * Filters the log out redirect URL.
+ *
+ * @since 4.2.0
+ *
+ * @param string $redirect_to The redirect destination URL.
+ * @param string $requested_redirect_to The requested redirect destination URL passed as a parameter.
+ * @param WP_User $user The WP_User object for the user that's logging out.
+ */
+ $redirect_to = apply_filters( 'logout_redirect', $redirect_to, $requested_redirect_to, $user );
+ wp_safe_redirect( $redirect_to );
+ exit();
+
+ case 'lostpassword':
+ case 'retrievepassword':
+ if ( $http_post ) {
+ $errors = retrieve_password();
+ if ( ! is_wp_error( $errors ) ) {
+ $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : 'wp-login.php?checkemail=confirm';
+ wp_safe_redirect( $redirect_to );
+ exit();
+ }
+ }
+
+ if ( isset( $_GET['error'] ) ) {
+ if ( 'invalidkey' == $_GET['error'] ) {
+ $errors->add( 'invalidkey', __( 'Your password reset link appears to be invalid. Please request a new link below.' ) );
+ } elseif ( 'expiredkey' == $_GET['error'] ) {
+ $errors->add( 'expiredkey', __( 'Your password reset link has expired. Please request a new link below.' ) );
+ }
+ }
- /**
- * Fires before the lost password form.
- *
- * @since 1.5.1
- */
- do_action( 'lost_password' );
-
- login_header(__('Lost Password'), '' . __('Please enter your username or email address. You will receive a link to create a new password via email.') . '
', $errors);
+ $lostpassword_redirect = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
+ /**
+ * Filters the URL redirected to after submitting the lostpassword/retrievepassword form.
+ *
+ * @since 3.0.0
+ *
+ * @param string $lostpassword_redirect The redirect destination URL.
+ */
+ $redirect_to = apply_filters( 'lostpassword_redirect', $lostpassword_redirect );
- $user_login = '';
+ /**
+ * Fires before the lost password form.
+ *
+ * @since 1.5.1
+ * @since 5.1.0 Added the `$errors` parameter.
+ *
+ * @param WP_Error $errors A `WP_Error` object containing any errors generated by using invalid
+ * credentials. Note that the error object may not contain any errors.
+ */
+ do_action( 'lost_password', $errors );
- if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
- $user_login = wp_unslash( $_POST['user_login'] );
- }
+ login_header( __( 'Lost Password' ), '' . __( 'Please enter your username or email address. You will receive a link to create a new password via email.' ) . '
', $errors );
+
+ $user_login = '';
-?>
+ if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
+ $user_login = wp_unslash( $_POST['user_login'] );
+ }
-
+
+
+
+
-
-
-%s', esc_url( wp_registration_url() ), __( 'Register' ) );
+
+
+ %s', esc_url( wp_registration_url() ), __( 'Register' ) );
- echo esc_html( $login_link_separator );
+ echo esc_html( $login_link_separator );
- /** This filter is documented in wp-includes/general-template.php */
- echo apply_filters( 'register', $registration_url );
-endif;
-?>
-
+ /** This filter is documented in wp-includes/general-template.php */
+ echo apply_filters( 'register', $registration_url );
+ endif;
+ ?>
+
-get_error_code() === 'expired_key' )
- wp_redirect( site_url( 'wp-login.php?action=lostpassword&error=expiredkey' ) );
- else
- wp_redirect( site_url( 'wp-login.php?action=lostpassword&error=invalidkey' ) );
- exit;
- }
+ if ( ! $user || is_wp_error( $user ) ) {
+ setcookie( $rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true );
+ if ( $user && $user->get_error_code() === 'expired_key' ) {
+ wp_redirect( site_url( 'wp-login.php?action=lostpassword&error=expiredkey' ) );
+ } else {
+ wp_redirect( site_url( 'wp-login.php?action=lostpassword&error=invalidkey' ) );
+ }
+ exit;
+ }
- $errors = new WP_Error();
+ $errors = new WP_Error();
- if ( isset($_POST['pass1']) && $_POST['pass1'] != $_POST['pass2'] )
- $errors->add( 'password_reset_mismatch', __( 'The passwords do not match.' ) );
+ if ( isset( $_POST['pass1'] ) && $_POST['pass1'] != $_POST['pass2'] ) {
+ $errors->add( 'password_reset_mismatch', __( 'The passwords do not match.' ) );
+ }
- /**
- * Fires before the password reset procedure is validated.
- *
- * @since 3.5.0
- *
- * @param object $errors WP Error object.
- * @param WP_User|WP_Error $user WP_User object if the login and reset key match. WP_Error object otherwise.
- */
- do_action( 'validate_password_reset', $errors, $user );
+ /**
+ * Fires before the password reset procedure is validated.
+ *
+ * @since 3.5.0
+ *
+ * @param object $errors WP Error object.
+ * @param WP_User|WP_Error $user WP_User object if the login and reset key match. WP_Error object otherwise.
+ */
+ do_action( 'validate_password_reset', $errors, $user );
- if ( ( ! $errors->get_error_code() ) && isset( $_POST['pass1'] ) && !empty( $_POST['pass1'] ) ) {
- reset_password($user, $_POST['pass1']);
- setcookie( $rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true );
- login_header( __( 'Password Reset' ), '' . __( 'Your password has been reset.' ) . ' ' . __( 'Log in' ) . '
' );
- login_footer();
- exit;
- }
+ if ( ( ! $errors->has_errors() ) && isset( $_POST['pass1'] ) && ! empty( $_POST['pass1'] ) ) {
+ reset_password( $user, $_POST['pass1'] );
+ setcookie( $rp_cookie, ' ', time() - YEAR_IN_SECONDS, $rp_path, COOKIE_DOMAIN, is_ssl(), true );
+ login_header( __( 'Password Reset' ), '' . __( 'Your password has been reset.' ) . ' ' . __( 'Log in' ) . '
' );
+ login_footer();
+ exit;
+ }
- wp_enqueue_script('utils');
- wp_enqueue_script('user-profile');
+ wp_enqueue_script( 'utils' );
+ wp_enqueue_script( 'user-profile' );
- login_header(__('Reset Password'), '' . __('Enter your new password below.') . '
', $errors );
+ login_header( __( 'Reset Password' ), '' . __( 'Enter your new password below.' ) . '
', $errors );
-?>
-
+
+
+
+
+
+ %s', esc_url( wp_registration_url() ), __( 'Register' ) );
+
+ echo esc_html( $login_link_separator );
-
-
-%s', esc_url( wp_registration_url() ), __( 'Register' ) );
+ /** This filter is documented in wp-includes/general-template.php */
+ echo apply_filters( 'register', $registration_url );
+ endif;
+ ?>
+
+
+
-
+ if ( ! get_option( 'users_can_register' ) ) {
+ wp_redirect( site_url( 'wp-login.php?registration=disabled' ) );
+ exit();
+ }
-' . __('Register For This Site') . '', $errors);
-?>
-
-
-
-
-
-
-
-
-
+
-break;
-
-case 'confirmaction' :
- if ( ! isset( $_GET['request_id'] ) ) {
- wp_die( __( 'Invalid request.' ) );
- }
+
+
+
+
+
- $request_id = (int) $_GET['request_id'];
+ ID) ) {
- $secure_cookie = true;
- force_ssl_admin(true);
+ /**
+ * Fires an action hook when the account action has been confirmed by the user.
+ *
+ * Using this you can assume the user has agreed to perform the action by
+ * clicking on the link in the confirmation email.
+ *
+ * After firing this action hook the page will redirect to wp-login a callback
+ * redirects or exits first.
+ *
+ * @since 4.9.6
+ *
+ * @param int $request_id Request ID.
+ */
+ do_action( 'user_request_action_confirmed', $request_id );
+
+ $message = _wp_privacy_account_request_confirmed_message( $request_id );
+
+ login_header( __( 'User action confirmed.' ), $message );
+ login_footer();
+ exit;
+
+ case 'login':
+ default:
+ $secure_cookie = '';
+ $customize_login = isset( $_REQUEST['customize-login'] );
+ if ( $customize_login ) {
+ wp_enqueue_script( 'customize-base' );
+ }
+
+ // If the user wants SSL but the session is not SSL, force a secure cookie.
+ if ( ! empty( $_POST['log'] ) && ! force_ssl_admin() ) {
+ $user_name = sanitize_user( $_POST['log'] );
+ $user = get_user_by( 'login', $user_name );
+
+ if ( ! $user && strpos( $user_name, '@' ) ) {
+ $user = get_user_by( 'email', $user_name );
+ }
+
+ if ( $user ) {
+ if ( get_user_option( 'use_ssl', $user->ID ) ) {
+ $secure_cookie = true;
+ force_ssl_admin( true );
+ }
+ }
+ }
+
+ if ( isset( $_REQUEST['redirect_to'] ) ) {
+ $redirect_to = $_REQUEST['redirect_to'];
+ // Redirect to HTTPS if user wants SSL.
+ if ( $secure_cookie && false !== strpos( $redirect_to, 'wp-admin' ) ) {
+ $redirect_to = preg_replace( '|^http://|', 'https://', $redirect_to );
+ }
+ } else {
+ $redirect_to = admin_url();
+ }
+
+ $reauth = empty( $_REQUEST['reauth'] ) ? false : true;
+
+ $user = wp_signon( array(), $secure_cookie );
+
+ if ( empty( $_COOKIE[ LOGGED_IN_COOKIE ] ) ) {
+ if ( headers_sent() ) {
+ $user = new WP_Error(
+ 'test_cookie',
+ sprintf(
+ /* translators: 1: Browser cookie documentation URL, 2: Support forums URL */
+ __( 'ERROR: Cookies are blocked due to unexpected output. For help, please see this documentation or try the support forums.' ),
+ __( 'https://wordpress.org/support/article/cookies/' ),
+ __( 'https://wordpress.org/support/' )
+ )
+ );
+ } elseif ( isset( $_POST['testcookie'] ) && empty( $_COOKIE[ TEST_COOKIE ] ) ) {
+ // If cookies are disabled we can't log in even with a valid user+pass
+ $user = new WP_Error(
+ 'test_cookie',
+ sprintf(
+ /* translators: %s: Browser cookie documentation URL */
+ __( 'ERROR: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.' ),
+ __( 'https://wordpress.org/support/article/cookies/#enable-cookies-in-your-browser' )
+ )
+ );
}
}
- }
- if ( isset( $_REQUEST['redirect_to'] ) ) {
- $redirect_to = $_REQUEST['redirect_to'];
- // Redirect to https if user wants ssl
- if ( $secure_cookie && false !== strpos($redirect_to, 'wp-admin') )
- $redirect_to = preg_replace('|^http://|', 'https://', $redirect_to);
- } else {
- $redirect_to = admin_url();
- }
-
- $reauth = empty($_REQUEST['reauth']) ? false : true;
-
- $user = wp_signon( array(), $secure_cookie );
+ $requested_redirect_to = isset( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
+ /**
+ * Filters the login redirect URL.
+ *
+ * @since 3.0.0
+ *
+ * @param string $redirect_to The redirect destination URL.
+ * @param string $requested_redirect_to The requested redirect destination URL passed as a parameter.
+ * @param WP_User|WP_Error $user WP_User object if login was successful, WP_Error object otherwise.
+ */
+ $redirect_to = apply_filters( 'login_redirect', $redirect_to, $requested_redirect_to, $user );
- if ( empty( $_COOKIE[ LOGGED_IN_COOKIE ] ) ) {
- if ( headers_sent() ) {
- /* translators: 1: Browser cookie documentation URL, 2: Support forums URL */
- $user = new WP_Error( 'test_cookie', sprintf( __( 'ERROR: Cookies are blocked due to unexpected output. For help, please see this documentation or try the support forums.' ),
- __( 'https://codex.wordpress.org/Cookies' ), __( 'https://wordpress.org/support/' ) ) );
- } elseif ( isset( $_POST['testcookie'] ) && empty( $_COOKIE[ TEST_COOKIE ] ) ) {
- // If cookies are disabled we can't log in even with a valid user+pass
- /* translators: 1: Browser cookie documentation URL */
- $user = new WP_Error( 'test_cookie', sprintf( __( 'ERROR: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.' ),
- __( 'https://codex.wordpress.org/Cookies' ) ) );
- }
- }
-
- $requested_redirect_to = isset( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
- /**
- * Filters the login redirect URL.
- *
- * @since 3.0.0
- *
- * @param string $redirect_to The redirect destination URL.
- * @param string $requested_redirect_to The requested redirect destination URL passed as a parameter.
- * @param WP_User|WP_Error $user WP_User object if login was successful, WP_Error object otherwise.
- */
- $redirect_to = apply_filters( 'login_redirect', $redirect_to, $requested_redirect_to, $user );
-
- if ( !is_wp_error($user) && !$reauth ) {
- if ( $interim_login ) {
- $message = '' . __('You have logged in successfully.') . '
';
- $interim_login = 'success';
- login_header( '', $message ); ?>
-
-
-
+ if ( ! is_wp_error( $user ) && ! $reauth ) {
+ if ( $interim_login ) {
+ $message = '' . __( 'You have logged in successfully.' ) . '
';
+ $interim_login = 'success';
+ login_header( '', $message );
+ ?>
+
+
+
-