[wp-trac] [WordPress Trac] #30598: Multisite Subdomain doesn't properly redirect users logging in to the primary site

[WordPress Trac]

#30598: Multisite Subdomain doesn't properly redirect users logging in to the
primary site
--------------------------------+-------------------------
 Reporter:  Ipstenu             |       Owner:  jeremyfelt
     Type:  defect (bug)        |      Status:  assigned
 Priority:  normal              |   Milestone:  4.5
Component:  Networks and Sites  |     Version:
 Severity:  normal              |  Resolution:
 Keywords:  has-patch           |     Focuses:  multisite
--------------------------------+-------------------------

Comment (by jeremyfelt):

 This is what happens in `wp-login.php` when a user logs in and a
 `redirect_to` query var is not provided:

 * If the user has a network account, but has no active site, redirect to
 `user_admin_url()`.
 * If the user does not have read capabilities on this site, redirect to
 the user's active site via `get_dashboard_url()`.
 * If the user has read capabilities for the site, but cannot edit posts,
 redirect to the user's profile page on that site via `admin_url(
 'profile.php' )`. In single site, it's also possible that `home_url()` is
 used here.

 Right now, we use `wp_safe_redirect()` for any redirect in `wp-login.php`
 because we also handle the unsafe `redirect_to` query var data. When doing
 this, a subdomain will not be found as a safe host (and likely shouldn't),
 and the redirect will go to an unexpected location, showing access denied.

 In the above list, we can instead use `wp_redirect()` for each condition
 because they do not involve unsafe data from the request or referrer. I
 think we can solve without adding complexity. [attachment:30598.2.diff]
 does this

--
Ticket URL: <https://core.trac.wordpress.org/ticket/30598#comment:9>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform