Hardcoded wp-login.php vs login_url filter?

[malthert]

The login_url filter allows changing allows changing the login URL.
However there are a few places, where wp-login.php is hardcoded.

Is the filter safe to use to modify the login url? Should (can?) those hardcoded wp-login.php in core be changed?

[sabernhardt]

Related tickets:

• #31830: BLOG_URLwp-login.php in wpmu_welcome_notification() (ms-functions.php and schema.php)
• #35177 (also #34925 and #35103): using the login_post scheme

[rajinsharwar]

#31830 was marked as a duplicate.

[rajinsharwar]

Putting this for 6.4, and marking it as an enhancement.

[oglekler]

This needs patch and I am also wondering if this can be marked as good-first-bug or not.

[faisal03]

Should all instances of site_url() with wp-login.php be changed?

for example:

<form class="admin-email-confirm-form" name="admin-email-confirm-form" action="<?php echo esc_url( site_url( 'wp-login.php?action=confirm_admin_email', 'login_post' ) ); ?>" method="post">

to something like?:

<form class="admin-email-confirm-form" name="admin-email-confirm-form" action="<?php echo esc_url( wp_login_url() . '?action=confirm_admin_email' ); ?>" method="post">

[oglekler]

There is also network_site_url().
I wonder if we need a new function that will return the path according to the action passed in, with the ability to filter that path so we can easily change it to something nice (without the action get parameter) - something to think about.

[oglekler]

There is no patch and no time before Beta 1 to finish and test it, so, I am moving this ticket into the 6.5 milestone.

[sabernhardt]

#35177 proposed a new wp_login_handler_url function that considers both network_site_url and site_url. The patch there would need updating.

I think this should be an "umbrella" task ticket, to keep track of related changes on tickets such as #31830 and #35177.