Changeset 4957

Timestamp:

02/20/2017 10:25:53 AM (8 years ago)

Author:

ocean90

Message:

WordPress.org SSO: Don't append an empty redirect_to argument to the lost password URL.

File:

• sites/trunk/common/includes/wporg-sso/wp-plugin.php (modified) (1 diff)

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -292 +292 @@
          * Filters the default lost password URL and returns our custom one instead.
          *
-         * @param string $lostpassword_url
-         * @param string $redirect
+         * @param string $lostpassword_url The lost password page URL.
+         * @param string $redirect         The path to redirect to on login.
+         * @return string New lost password URL.
          */
         public function lostpassword_url( $lostpassword_url, $redirect ) {
-            return $this->sso_host_url . $this->valid_sso_paths['lostpassword'] . '/?redirect_to=' . $redirect;
+            $lostpassword_url = $this->sso_host_url . $this->valid_sso_paths['lostpassword'];
+
+            if ( ! empty( $redirect ) ) {
+                $lostpassword_url = add_query_arg( 'redirect_to', $redirect, $lostpassword_url );
+            }
+
+            return $lostpassword_url;
         }