Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

wp-login.php uses $_REQUEST['redirect_to'] as a way to override redirection for lostpassword link. However, it doesn't seem to work for some reason. Maybe its my server environment, but $_REQUEST['redirect_to'] value is unset even if I explicitly pass it as a GET variable in the URI.

Is this a wordpress thing or something possibly with my hosting environment or just me being a newb?

I saw another post where user @rarst mentioned WP implements its own logic behavior to enforce REQUEST as a combo of GET and POST. But I don't see the code he's talking about anywhere in wp-login and not in wp-load, either. So I'm guessing that REQUEST on wp-login behaves however the php environment is configured for it to behave.

Anyone have some insight on this?

share|improve this question
add comment

1 Answer 1

The redirect_to variable works fine, even as a GET variable, however wp-login.php also uses wp_safe_redirect() for doing the actual redirection, which means that the URL must be on the same website. You can't redirect to anywhere in the web, just to the same site as the login is located on. This is to prevent some sorts of XSS issues.

share|improve this answer
    
Thanks, Otto. I'm glad it works fine for someone else, so I know I'm not crazy or something. But no matter what I did, it wouldn't work. I tested super hardcore and I got other variable names to work fine but redirect_to always showed up as an empty string. I thought maybe it was being overridden by a cookie, but I couldn't find that to be the case. I'm pretty unfamiliar with cookies, though. I ended up doing a work-around that I wasn't fond of. –  pha3z Nov 11 '12 at 7:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.