redirect_to Doesn’t Work

Hello.

From what I can tell, the support for the redirect_to parameter in the login link does not work. In digging into the implementation of the init_wtlwp() function in the public/class-wp-temporary-login-without-password-public.php file, I believe the issue is an improperly implementation of the login_redirect filter.

The current implementation (plugin version 1.5.9) is passing the default redirection (the admin URL) as the first variable, a ternary test for $_REQUEST['redirect_to'] variable as the second variable, and then the $user variable as the third. Per the documentation at https://codex.ww.wp.xz.cn/Plugin_API/Filter_Reference/login_redirect the second variable should be the URL the user is coming from, not the alternate redirect target.

My proposal would be to change lines 88 and 89 from:

$redirect_to     = admin_url();
$redirect_to_url = apply_filters( 'login_redirect', $redirect_to, isset( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '', $user ); // phpcs:ignore

To

$redirect_to     = isset( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : admin_url();
$redirect_to_url = apply_filters( 'login_redirect', $redirect_to, false, $user ); // phpcs:ignore

which correctly substitutes an alternate URL provided through the redirect_to parameter for the default admin URL value.

Any thoughts on this or alternate reasons why appending &redirect_to=[encoded url] to my login links doesnt change the redirection?

Thanks.
-Andre

• This topic was modified 7 years, 8 months ago by erdnapc. Reason: added code formatting to proposed changes