[wp-trac] [WordPress Trac] #35103: login_url Filter is now applied to Login Form Action Attribute

[WordPress Trac]

#35103: login_url Filter is now applied to Login Form Action Attribute
------------------------------------+-----------------------------
 Reporter:  salcode                 |      Owner:
     Type:  defect (bug)            |     Status:  new
 Priority:  normal                  |  Milestone:  Awaiting Review
Component:  Login and Registration  |    Version:  trunk
 Severity:  normal                  |   Keywords:
  Focuses:                          |
------------------------------------+-----------------------------
 Previously, the `login_url` filter was **not** applied to the `action`
 attribute on the form element of the login form.

 This allowed setting up a custom login page and using the `login_url`
 filter to point to it.

 For example,


 {{{
 add_filter( 'login_url', 'new_login_url', 10, 2 );
 function new_login_url( $login_url, $redirect ) {
     return '/log-in/';
 }
 }}}
 taken from https://trepmal.com/2011/04/07/redirect-users-to-a-custom-log-
 in-page/.

 With the changes introduced in [34213], the `action` attribute now uses
 `wp_login_url()` instead of `site_url( 'wp-login.php', 'login_post' )`.
 This applies the `login_url` attribute filter to the action attribute,
 which should not be.

 `site_url()` differentiates between `login` and `login_post` based on the
 scheme parameter, however `wp_login_url()` does not.  `wp_login_url()`
 uses a scheme parameter of `login`, which makes it inappropriate for use
 as the `action` attribute of the form element (since we want a scheme of
 `login_post` in this case).

 See #34925 for a related discussion on another impact of the form `action`
 attribute using the `login` rather than `login_post` scheme

--
Ticket URL: <https://core.trac.wordpress.org/ticket/35103>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform