function bp_core_no_access redirects incorrectly when WP_SITEURL is defined

[lackingpenguin]

The function bp_core_no_access() defined on line 397 of /bp-core/bp-core-catchuri.php incorrectly defines the $redirect variable as the site root when WP_SITEURL is defined manually in wp-config.php.

In plain english, here's what happens. Normally, if a user tries to access a page they don't have the right to access, buddypress will redirect them to the wp-login.php page with the ?redirect_to variable set to the page that the user just tried to visit. When the user successfully logs in, wordpress sends them back to that page.

When you manually define WP_SITEURL in wp-config.php however, buddypress always redirects you to the homepage no matter where you came from before. This is quite annoying.

The reason this is happening is that bp_core_no_access() uses wp_guess_url() [defined on line 3760 of /wp-includes/functions.php] to define the URL to redirect users to after successful login. This is fine when WP_SITEURL is not defined, but when WP_SITEURL is defined wp_guess_url() returns simply WP_SITEURL (the homepage of the site) without any addition information. So the user is always redirected to the homepage no matter where they came from in the first place.

Either wp_guess_url() is not performing correctly, or bp_core_no_access() is USING it incorrectly.

Either way, seems to me that the $redirect variable of bp_core_no_access() should default to something like:

'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']

instead of defaulting to wp_guess_url().

Good luck, and email lackingpenguin@… if you have any questions.

[r-a-y]

Good call about the usage of wp_guess_url(). (My fault, since it was my chunk of code that was added to the codebase!)

I've attached a patch against the trunk version of BP.

In the meantime, you can hook into the "bp_core_no_access" or "bp_no_access_redirect" filter to override wp_guess_url().

[johnjamesjacoby]

(In [5767]) Use server info instead of wp_guess_url() in bp_core_no_access(). Fixes #3976. Props lackingpenguin, r-a-y.