Return 401 response on failed login and use wp_signon #6647

Question

Fixes #6647

Proposed Changes: 1. Adds a 401 status header when a login is failed. 2. Remove validation done by EDD so that core actions can run 3. Modify edd_log_user_in to use wp_signon instead of just setting cookies and doing actions, so that core actions can run.

该提问来源于开源项目：easydigitaldownloads/easy-digital-downloads

Answer 1

It's working on the RCP and AffWP sites as we speak.

On Mon, Aug 17, 2020, 12:30 PM Spencer Finnell wrote:

** commented on this pull request.

In includes/login-register.php https://github.com/easydigitaldownloads/easy-digital-downloads/pull/8085#discussion_r471728743 :

@@ -31,6 +31,12 @@ function edd_login_form( $redirect = '' ) {

ob_start();

• if ( ! empty( edd_get_errors() ) ) {
• if ( array_key_exists( 'edd_invalid_login', edd_get_errors() ) ) {
• status_header( 401 );

https://github.com/cklosowski I don't think this will actually change the status header since the function checks headers_sent() before attempting to update: https://core.trac.wordpress.org/browser/tags/5.5/src/wp-includes/functions.php#L1423

Instead I think the list of errors needs to be checked on the template_redirect action and the status header set then.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/easydigitaldownloads/easy-digital-downloads/pull/8085#pullrequestreview-468774728, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAKTMLAKWDI5TH66T74F2ALSBGAM5ANCNFSM4QB76IPA .