[wp-trac] [WordPress Trac] #31495: Always use 'login' as $scheme parameter for "login-ish" URLs, and other inconsistencies

[WordPress Trac]

#31495: Always use 'login' as $scheme parameter for "login-ish" URLs, and other
inconsistencies
------------------------------------+-----------------------------
 Reporter:  GregLone                |      Owner:
     Type:  defect (bug)            |     Status:  new
 Priority:  normal                  |  Milestone:  Awaiting Review
Component:  Login and Registration  |    Version:  4.1.1
 Severity:  normal                  |   Keywords:
  Focuses:                          |
------------------------------------+-----------------------------
 Hi.

 I found a lot of references of `site_url()` used for
 login/register/whatever that do not use the second parameter `$scheme` (it
 should be 'login'). But this is a first step, we should use
 `wp_login_url()`, `wp_registration_url()`, and friends.

 So far I found the following:

 '''In wp-signup.php:'''
 `wp_redirect( site_url('wp-login.php?action=register') );` should use
 `wp_registration_url()`.

 `$login_url = site_url( 'wp-login.php?redirect_to=' . urlencode(
 network_site_url( 'wp-signup.php' ) ) );` should use `wp_login_url(
 network_site_url( 'wp-signup.php' ) )`.

 Even worse, the function `confirm_another_blog_signup()` uses `"http://" .
 $domain.$path . "wp-login.php"`.

 '''In wp-activate.php:'''
 `wp_redirect( site_url( '/wp-login.php?action=register' ) );` should use
 `wp_registration_url()`.
 Also note the "/" at the beginning. Not important, but not consistent with
 other URLs.

 And few lines later:
 `$url . 'wp-login.php'` should be replaced by `get_site_url( (int)
 $result['blog_id'], 'wp-login.php', 'login' )` imho.

 I also wonder if `network_site_url('wp-login.php', 'login')` shouldn't be
 replaced by `site_url('wp-login.php', 'login')`, since this is the only
 file where it is used that way anyway.

 '''In wp-includes/canonical.php:'''
 `wp_redirect( site_url('wp-login.php?action=register') );` should use
 `wp_registration_url()`.

 '''In wp-admin/install.php''':
 There's a `'</p><p class="step"><a href="../wp-login.php" class="button
 button-large">' . __( 'Log In' ) . '</a></p></body></html>'`.
 And another `<a href="../wp-login.php" class="button button-large"><?php
 _e( 'Log In' ); ?></a>`.

 '''In wp-includes/ms-functions.php''':
 There is `Log in here: BLOG_URLwp-login.php` in an email template.
 And another `<a href="../wp-login.php" class="button button-large"><?php
 _e( 'Log In' ); ?></a>`.

 '''In wp-admin/network.php''':
 `<a href="<?php echo esc_url( site_url( 'wp-login.php' ) ); ?>"><?php _e(
 'Log In' ); ?></a>`

 '''In wp-includes/schema.php''':
 There is `Log in here: BLOG_URLwp-login.php` in an email template.

 Any thought?

--
Ticket URL: <https://core.trac.wordpress.org/ticket/31495>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform