Hard coded wp-login.php url in string

[lenasterg]

Hi.
I noticed that in
wp-includes/ms-functions.php (wpmu_welcome_notification)
the login url is hardcoded (wp-login.php) into the string.
This will create a problem if a multisite developer has chosen to change the login page url (for security reasons).

Thanks in advance
Lena

[jeremyfelt]

Hi lenasterg, thanks for opening a ticket!

It would be nice to change the reliance on wp-login.php as part of the URL. Right now the answer is to use a filter for the entire email through update_welcome_email.

Considering the version of the welcome email stored in the database has existed with BLOG_URLwp-login.php as part of it since pre-3.0, we would need to be careful making any changes. Even if with schema update, two versions of the email would need to be supported in order to maintain backward compatibility. It would be interesting to see a possible solution to this.

Introduced in [12603]

[rajinsharwar]

Hey @lenasterg, thanks for your ticket! Let's track the issue on #56224, as that will, of course, cover the instance you mentioned. Marking this as a Duplicate of that ticket, so that we can fix the issue in the full core, rather than a single file one by one.

[sabernhardt]

This change is quite different from other hardcoded wp-login.php instances, so it should be better to make a separate patch and test it on its own.