skepchick

Just in case the plugin is dead, I did a little research and might have found a fix. I edited the JSON for the image with caption component on the theme I’m using (modern) to add this line:
"format": "html",

I can’t tell if it’s working yet as I have a lot of trouble figuring out if the changes I make are pushed live immediately, especially since I’m dealing with drafts, which I’m also having trouble updating and seeing updates show up in icloud. To fix this I’ve submitted articles without HTML captions on images so I might get approved and can then make edits and hopefully see them live.

Jeremy: I think that was it! Thank you so much.

And at long last, the final resolution: went to theme-my-login/includes/class-theme-my-login.php, changed line 347 to $redirect_to = admin_url( ‘user/’ );

All fixed.

Should I also mention that I tried no other plugins running and using Twentyten and it still didn’t work?

For courtesy, this will be my last bump unless I figure out a solution. Otherwise, I’ll just try to adapt another login plugin to my needs.

It worked! I renamed the plugins file (without turning off domain mapping which was in the mu-plugins, just to experiment), and could once again create subdomains. So yes, it must be a plugin that’s not compliant with 3.1.

It is a bit frustrating that a plugin activated on one site in a network can screw up something that important, but I’m just happy the fix was so easy.

Thanks so much for your help! I’ll mark the thread as resolved, which I hope still allows me to update in case I eventually care to figure out which plugin is the culprit.

Can do, but a possibly dumb question: is there an easy way to do that? Or do I have to disable all plugins on every site in my network?

(Currently there are no network activated plugins.)

Thank you, Mikey1. I’ve banned every IP he has tried, and in fact my server has now banned large swaths of Central America just for him. He continues to use proxies, which we’re also banning, but he is rabid and quite literally insane, with nothing to do with his time but try to ruin my day. Yeah, it’s flattering really. 🙂

So, the main problem is that to request a password reset, you do not need to have an account. All you have to do is click a link and enter a user name or email address, and the system will send an email to that account with a link to reset the pw. That means that the solution is not to ban this user, but to strengthen the code so that he and his scripts are stopped. A good CAPTCHA should do this, but I’m unfamiliar with the code. I’ve found a simple tutorial and will start learning the code (this is how I solve most problems with the software), but I hoped someone here had already gone through the process and had something I could implement a little more quickly.

In the meantime, I’ve edited the wp-login.php to disable automatic password reset. I’d rather a few people have to wait to reset their passwords than to have hundreds of users continually spammed by my own site.