Changeset 6031

Timestamp:

05/14/2012 01:21:30 PM (12 years ago)

Author:

boonebgorges

Message:

Refactors bp_core_login_redirect() for better extensibility and flow

This patch does the following:

• Eases the restriction on login redirects to wp-admin. Previously, all such redirects were bounced back to the home page. While this restriction makes sense for the majority of users on the majority of BP installs (who never need to see the Dashboard), it was a pain for Administrators and other users who have legitimate reasons to visit wp-admin pages, especially when clicking directly on links in WP notification emails. This changeset allows login redirects to wp-admin to succeed when users are of the Contributor level or higher.
• Introduces a filter bp_core_login_redirect, which allows plugins to override the default behavior of bp_core_login_redirect() for some users, without requiring that they unhook the function altogether.

Fixes #4199
Props djpaul, Jonathan Davis for help conceputalizing and testing

File:

• trunk/bp-core/bp-core-filters.php (modified) (1 diff)

trunk/bp-core/bp-core-filters.php

@@ -114 +114 @@
 
 /**
- * bp_core_login_redirect()
- *
- * When a user logs in, always redirect them back to the previous page. NOT the admin area.
- *
- * @package BuddyPress Core
- */
-function bp_core_login_redirect( $redirect_to ) {
-    global $wpdb;
-
-    // Don't mess with the redirect if this is not the root blog
-    if ( is_multisite() && $wpdb->blogid != bp_get_root_blog_id() )
+ * When a user logs in, redirect him in a logical way
+ *
+ * @package BuddyPress Core
+ *
+ * @uses apply_filters Filter bp_core_login_redirect to modify where users are redirected to on
+ *   login
+ * @param string $redirect_to The URL to be redirected to, sanitized in wp-login.php
+ * @param string $redirect_to_raw The unsanitized redirect_to URL ($_REQUEST['redirect_to'])
+ * @param obj $user The WP_User object corresponding to a successfully logged-in user. Otherwise
+ *   a WP_Error object
+ * @return string The redirect URL
+ */
+function bp_core_login_redirect( $redirect_to, $redirect_to_raw, $user ) {
+
+    // Only modify the redirect if we're on the main BP blog
+    if ( !bp_is_root_blog() ) {
         return $redirect_to;
-
-    // If the redirect doesn't contain 'wp-admin', it's OK
-    if ( !empty( $_REQUEST['redirect_to'] ) && false === strpos( $_REQUEST['redirect_to'], 'wp-admin' ) )
+    }
+
+    // Only modify the redirect once the user is logged in
+    if ( !is_a( $user, 'WP_User' ) ) {
         return $redirect_to;
-
-    if ( false === strpos( wp_get_referer(), 'wp-login.php' ) && false === strpos( wp_get_referer(), 'activate' ) && empty( $_REQUEST['nr'] ) )
+    }
+
+    // Allow plugins to allow or disallow redirects, as desired
+    $maybe_redirect = apply_filters( 'bp_core_login_redirect', false, $redirect_to, $redirect_to_raw, $user );
+    if ( false !== $maybe_redirect ) {
+        return $maybe_redirect;
+    }
+
+    // If a 'redirect_to' parameter has been passed that contains 'wp-admin', verify that the
+    // logged-in user has any business to conduct in the Dashboard before allowing the
+    // redirect to go through
+    if ( !empty( $_REQUEST['redirect_to'] ) && ( false === strpos( $_REQUEST['redirect_to'], 'wp-admin' ) || user_can( $user, 'edit_posts' ) ) ) {
+        return $redirect_to;
+    }
+
+    if ( false === strpos( wp_get_referer(), 'wp-login.php' ) && false === strpos( wp_get_referer(), 'activate' ) && empty( $_REQUEST['nr'] ) ) {
         return wp_get_referer();
+    }
 
     return bp_get_root_domain();
 }
-add_filter( 'login_redirect', 'bp_core_login_redirect' );
+add_filter( 'login_redirect', 'bp_core_login_redirect', 10, 3 );
 
 /***