Visibility: password-protected breaks with redirected domains

[monkeyhouse]

Pre-requisite to reproduce: domain.com must redirect to www.domain.com (haven't tested with other subdomains than www, but I'm sure it would be the same).

1. password protect a page
2. visit domain.com/protected (which redirects to www.domain.com/protected)
3. enter password
4. something about the redirect OR the way the password is stored/checked is broken; you are redirected to the wp-admin (WordPress login) page.

Sanity check:

1. password protect a page
2. visit www.domain.com/protected (requiring no subdomain redirect)
3. enter password
4. successful log-in

[solarissmoke]

Tried the procedure you describe and it works fine for me. Are you using server rewrite rules to do the non-www -> www redirect?

[dd32]

Confirmed.

1. Visited ​http://127.0.0.1/wordpress/password-protected-post/
2. Entered password, Form submitted to ​http://localhost/wordpress/wp-pass.php
3. Redirected to ​http://localhost/wordpress/wp-admin/

[dd32]

This is caused by wp-post.php using wp_safe_redirect(wp_get_referer()); for the redirection.

Since the referer is set to ​http://127... instead of ​http://localhost.. and i'm logged in, it'll redirect me to the WordPress admin.

Ideally, the best way to do this would be to POST the post_id along to wp-pass.php as well, and redirect to get_permalink($post_id);

[duck_]

Replying to dd32:

Ideally, the best way to do this would be to POST the post_id along to wp-pass.php as well, and redirect to get_permalink($post_id);

Taken a slightly different approach by forcing _wp_http_referer to be the permalink. Was unable to quickly reproduce the problem for testing, but this should work.

[dd32]

makes a bit more sense there.

Also related, and I'll probably fix at the same time: #16483

[MikeHansenMe]

I was able to recreate the problem with version 3.5-alpha-21751 and installed the patch.
The patch corrected the redirect for me. I am unsure if there may be a better way to handle this but it works.

[nacin]

#23412 was marked as a duplicate.

[nacin]

Replying to duck_:

Replying to dd32:

Ideally, the best way to do this would be to POST the post_id along to wp-pass.php as well, and redirect to get_permalink($post_id);

Taken a slightly different approach by forcing _wp_http_referer to be the permalink. Was unable to quickly reproduce the problem for testing, but this should work.

[nacin]

After nearly committing this patch (changing esc_attr() to esc_url()), I noticed that it would cause a redirect back to the post, not to the screen they are on (such as an archive page). Let's at least make sure we are OK with that first.

[MikeHansenMe]

Refreshed

[MikeHansenMe]

Refreshed and changed esc_attr to esc_url as nacin mentioned

[chriscct7]

Looks good patch wise. I think it's fine to send them back to the post, because they're logging in because they want to access that post. It'd be better if it went back to the same screen if possible