bbPress plugin takes over redirect_to in wp-login.php

[sc0ttkclark]

I've got a vanilla Twenty Ten theme setup on a site which I installed bbPress on. Upon going to mysite.com/wp-admin/ I am taken to the wp-login.php page with my previous URL set in the redirect_to (as expected). After entering my credentials and submitting the login form, I am unexpectedly redirected to the 'wpurl', which in my case is at mysite.com/

I'm expecting the redirect_to to hold and not be ignored. Upon deactivating bbPress, the issue goes away.

[johnjamesjacoby]

This is actually done by design to prevent your average user from logging in, and then being redirected away from the familiar front end website and into what is probably a very empty WP admin area (since they will most likely be a user of a default role.)

The idea is you as a site admin can cope easier with 1 extra click than millions of normal users can with being redirected into unfamiliar territory.

Closing this since it's technically not a bug. Open to a compelling patch that is more intelligent though. Something that maybe doesn't force the front-end around if you're an admin/super admin?

[sc0ttkclark]

Really opposed to this, will write a more descriptive proposal and/or a patch soon.

[johnjamesjacoby]

I understand your proposal, no need spend time to be more descriptive.

We've ran similar (almost identical) code in BuddyPress since 1.0 with no complaints that I can remember.

[johnjamesjacoby]

For what it's worth, you can turn the redirect off easily:

remove_filter( 'login_redirect', 'bbp_redirect_login', 2, 3 );

[sc0ttkclark]

It is my understanding that BuddyPress itself is used more as the core of a site than bbPress. "Oh, I want to add a forum to my site" use-case would be much more likely than "My site is a forum with stuff added on" so I believe the best option here would be to either make it optional to redirect to front of site after login (overriding any redirect_to used in WP core and existing site's plugins, themes, and/or links), make it optional for admins (seems like a half-way solution), or make it optional based on role(s) (allowing you to check off which roles should be redirected to home page vs wp-admin).

Anything less would be unsatisfactory for the bulk of developers who have depended on usage of redirect_to on the login page. If this is as easy as me putting together a patch with an added option on the Settings >> Forums admin page, then let's make sure that's clear. Obviously, a setting is preferred over removing a filter through additional code since this effects so many sites and developers. Either way, this shouldn't be treated as a bug based on your description and treated as an enhancement which is necessary.

I understand if you are hesitant to add an option since you've not seen the use-case for such an option, I would suggest looking at this from the new plugin view as this is now in WP Plugin territory versus standalone and should take into account the effect it does have with so many existing sites, especially users who aren't technical.

[johnjamesjacoby]

I completely understand the use case.

There are several other ways for capable admins to access wp-admin, via things like widgets and menus. The issue is the average user experience of logging into ​http://wordpress.org/support/ and instead of being redirected to ​http://wordpress.org/support/, getting dropped into an empty ​http://wordpress.org/wp-admin/ where they have no post/page capabilities, staring at a mostly empty dashboard. It's unfamiliar and undesirable as a user.

The fact that wp-login.php defaults redirects to wp-admin rather than the front of the site makes sense for 1 user on one blog, but I disagree that it's the optimal situation for users of a community powered website.

I'd also rather not have this require configuration in bbPress core for 100% of everyone that downloads it. It makes more sense to set this once for the majority of users, and let savvy developers such as yourself create a plugin to do the advanced user options and interfaces.

[sc0ttkclark]

Here's a solution: Don't override redirect_to unless it's empty. Does that suffice?

[sc0ttkclark]

Sorry, had to edit my last reply, I mistyped. If you want to override a legitimate redirect_to with the bbPress plugin, what's the reasoning behind that? I can see why you want wp-admin to not be the first screen someone is taken to upon login, which seems like perhaps something that WP Core should fix or an additional plugin should be able to address. Hate to go against the grain, but I'll make a plugin to override the bbPress redirect_to hijacking functionality if it is not intended to be resolved.

[johnjamesjacoby]

(In [3208]) Use the raw_url on login_redirect if one is passed. Otherwise check if $url is empty or is sending the user to admin_url(), and default to home_url() to prevent users from being bounced into the admin area unexpectedly. See #1530.