wp_login action can't deal with alternate auth mechanisms

[Otto42]

In the wp_signon function, the action hook for wp_login is called like this:
do_action('wp_login', $credentials['user_login']);

Problem is that $credentials['user_login'] is the content of the form field passed to it by the login screen. If an alternate authentication mechanism is used (like via Twitter or Facebook), then the action does not get the resulting user name that is logging in.

Fix:

If the $user variable is_a WP_User object, then the value passed to this action hook should be $user->user_login instead, so as to pass the login name of the authenticated user to the action.

[Otto42]

wp_login action hook fix

[Otto42]

Bump. Any traction here? This change would help solve some problems for users wanting alternate login mechanisms, and it's backwards compatible.

[SergeyBiryukov]

Code reference: ​http://core.trac.wordpress.org/browser/tags/3.2.1/wp-includes/user.php#L53

Wouldn't $user always be a WP_User object at this point, since WP_Error is handled earlier? We can probably skip the check.

15473.patch​ passes $user->user_login and adds $user as a second parameter, as suggested in #17085.

[ryan]

In [18741]:

Pass the authenticated user_login to the wp_login action. Props Otto42, SergeyBiryukov. fixes #15473