You do not have permission to access this document on form submit

Question

I have few little problem. If i submitted the user credential for login no matter login detail correct or incorrect page goes to Forbidden on submit button. What i do for this problem

Forbidden page is here after submit.

And code is here for login

public function loginForm(){
    if(!session_id()){
        @session_start();
    }
    global $post;
    $redirect_page = get_option('redirect_page');
    $redirect_page_url = get_option('redirect_page_url');
    $logout_redirect_page = get_option('logout_redirect_page');
    $link_in_username = get_option('link_in_username');
    $default_login_form_hooks = get_option('default_login_form_hooks');

    if($redirect_page_url){
        $redirect = $redirect_page_url;
    } else {
        if($redirect_page){
            $redirect = get_permalink($redirect_page);
        } else {
            $redirect = $this->curPageURL();
        }
    }

    if($logout_redirect_page){
        $logout_redirect_page = get_permalink($logout_redirect_page);
    } else {
        $logout_redirect_page = $this->curPageURL();
    }
    $this->load_script();
    $this->error_message();
    if(!is_user_logged_in()){
    ?>
    <div id="log_forms">
    <form name="login" id="login" method="post" action="">
    <input type="hidden" name="option" value="afo_user_login" />
    <input type="hidden" name="redirect" value="<?php echo esc_url( $redirect ); ?>" />
    <div class="form-group">
        <label for="username"><?php _e('Username','login-sidebar-widget');?> </label>
        <input type="text" name="user_username" required="required"/>
    </div>
    <div class="form-group">
        <label for="password"><?php _e('Password','login-sidebar-widget');?> </label>
        <input type="password" name="user_passwords" required="required"/>
    </div>
    <?php do_action('login_afo_form');?>
    <?php $default_login_form_hooks == 'Yes'?do_action('login_form'):'';?>
    <div class="form-group">
        <?php $this->add_remember_me();?>
    </div>
    <div class="form-group"><label for="login">&nbsp;</label><input name="login" type="submit" value="<?php _e('Login','login-sidebar-widget');?>" /></div>
    <div class="form-group">
        <?php $this->add_extra_links();?>
    </div>
    </form>
    </div>
    <?php 
    } else {
    global $current_user;
    get_currentuserinfo();

    if($link_in_username){
        $link_with_username = '<a href="'. esc_url( get_permalink($link_in_username) ) .'">'.__('Howdy','login-sidebar-widget').', '.$current_user->display_name.'</a>';
    } else {
        $link_with_username = __('Howdy','login-sidebar-widget').', '.$current_user->display_name;
    }
    ?>
    <ul style="list-style-type:none;">
        <li><?php echo $link_with_username;?> | <a href="<?php echo wp_logout_url( $logout_redirect_page ); ?>" title="<?php _e('Logout','login-sidebar-widget');?>"><?php _e('Logout','login-sidebar-widget');?></a></li>
    </ul>
    <?php 
    }
}

Answer 1

Your form action point to the url in which the login form is displayed, and this is many times not the desired behavior when you write your own login form. You should let the login end point handle the login. The result should be something like

<form .... action="<?php echo esc_url( site_url( 'wp-login.php', 'login_post' ) )?> ">

Where site_url( 'wp-login.php', 'login_post') is the specific way to find the login end point.

Obviously when using plugins that mess around with the end point, you are at the mercy of the quality of the implementation.