Changeset 4957

Timestamp:

02/20/2017 10:25:53 AM (10 years ago)

Author:

ocean90

Message:

WordPress.org SSO: Don't append an empty redirect_to argument to the lost password URL.

File:

• sites/trunk/common/includes/wporg-sso/wp-plugin.php (modified) (1 diff)

sites/trunk/common/includes/wporg-sso/wp-plugin.php

@@ -292 +292 @@
                  * Filters the default lost password URL and returns our custom one instead.
                  *
-                 * @param string $lostpassword_url
-                 * @param string $redirect
+                 * @param string $lostpassword_url The lost password page URL.
+                 * @param string $redirect         The path to redirect to on login.
+                 * @return string New lost password URL.
                  */
                 public function lostpassword_url( $lostpassword_url, $redirect ) {
-                        return $this->sso_host_url . $this->valid_sso_paths['lostpassword'] . '/?redirect_to=' . $redirect;
+                        $lostpassword_url = $this->sso_host_url . $this->valid_sso_paths['lostpassword'];
+
+                        if ( ! empty( $redirect ) ) {
+                                $lostpassword_url = add_query_arg( 'redirect_to', $redirect, $lostpassword_url );
+                        }
+
+                        return $lostpassword_url;
                 }