Rename wp-login.php - Version 2.3

Version Description

WordPress 3.9 compatible.
Fix issue where the slug reverts to default when saving the permalink structure.

Release Info

Developer	avryl
Plugin	Rename wp-login.php
Version	2.3
Comparing to
See all releases

Code changes from version 2.2.7 to 2.3

Files changed (5) hide show

readme.md +0 -137
readme.txt +9 -2
rename-wp-login.php +18 -5
rwl-login.php → rwl-login-3.8.php +0 -0
rwl-login-3.9.php +938 -0

readme.md DELETED Viewed

@@ -1,137 +0,0 @@
-            -
            # Rename wp-login.php
-            -
-            -
            **Contributors:** avryl
-            -
            **Tags:** rename, login, wp-login, wp-login.php, brute force attacks, custom login url, security
-            -
            **Requires at least:** 3.8
-            -
            **Tested up to:** 3.8.1
-            -
            **Stable tag:** 2.2.7
-            -
            **License:** GPLv2 or later
-            -
            **License URI:** http://www.gnu.org/licenses/gpl-2.0.html
-            -
-            -
            Change wp-login.php to anything you want. It can also prevent a lot of brute force attacks.
-            -
-            -
            ## Description
-            -
-            -
            *Rename wp-login.php* is a very light plugin that lets you easily and safely change wp-login.php to anything you want. It doesn’t literally rename or change files in core, nor does it add rewrite rules. It simply intercepts page requests and works on any WordPress website. The wp-admin directory and wp-login.php page become inaccessible, so you should bookmark or remember the url. Deactivating this plugin brings your site back exactly to the state it was before.
-            -
-            -
            ### Compatibility
-            -
-            -
            Requires WordPress 3.8 or higher. All login related things such as the registration form, lost password form, login widget and expired sessions just keep working.
-            -
-            -
            It’s also compatible with any plugin that hooks in the login form, including
-            -
-            -
            * BuddyPress,
-            -
            * bbPress,
-            -
            * Limit Login Attempts,
-            -
            * and User Switching.
-            -
-            -
            Obviously it doesn’t work with plugins that *hardcoded* wp-login.php.
-            -
-            -
            This also works with multisite! Activating it for a network allows you to set a networkwide default. Individual sites can still rename their login page to something else.
-            -
-            -
            If you’re using a **page caching plugin** you should add the slug of the new login url to the list of pages not to cache. For W3 Total Cache and WP Super Cache this plugin will give you a message with a link to the field you should update.
-            -
-            -
            ### Benefits
-            -
-            -
            Not only does it allow you to further customise your login page, it also prevents brute force attacks that are targeted specifically to wp-login.php. Both the wp-login.php page and the wp-admin directory (if not logged in) become inaccessible.
-            -
-            -
            While you could use this plugin to prevent a lot of brute force attacks, it does not mean you don’t need a strong password. Read [this codex article](http://codex.wordpress.org/Brute_Force_Attacks) for more information on how to protect your website.
-            -
-            -
            Of course, if you want to keep your login page secret, you should make sure there aren’t any links pointing to it on your website.
-            -
-            -
            ## Installation
-            -
-            -
            1. Go to Plugins › Add New.
-            -
            2. Search for *Rename wp-login.php*.
-            -
            3. Look for this plugin, download and activate it.
-            -
            4. The page will redirect you to the settings. Rename wp-login.php in there.
-            -
            5. You can change this option any time you want, just go back to Settings › Permalinks › Rename wp-login.php.
-            -
-            -
            ## Frequently Asked Questions
-            -
-            -
            ### I forgot my login url!
-            -
-            -
            Either go to your MySQL database and look for the value of `rwl_page` in the options table, or remove the `rename-wp-login` folder from your `plugins` folder, log in through wp-login.php and reinstall the plugin.
-            -
-            -
            ## Changelog
-            -
-            -
            ### 2.2.4
-            -
-            -
            * Fixed SSL issues.
-            -
            * Set REQUEST_URI back.
-            -
            * Check if wp-login.php functions exist to avoid future fatal errors.
-            -
-            -
            ### 2.2.3
-            -
-            -
            * Fixed URL filters.
-            -
-            -
            ### 2.2
-            -
-            -
            * Fixed issue where requests redirect to the new login page.
-            -
            * Trailing slash based on the permalink structure.
-            -
-            -
            ### 2.1
-            -
-            -
            * Works now with non-pretty permalinks!
-            -
            * Gives a message when using W3 Total Cache or WP Super Cache to update options.
-            -
-            -
            ### 2.0.1
-            -
-            -
            * Prevents pretty redirects such as /login and /admin.
-            -
            * Simplifies some code.
-            -
            * Forces login page with trailing slash.
-            -
            * Replaces a wp_redirect with wp_safe_redirect.
-            -
            * Shows error message in the network admin if permalinks are not enabled for the main site.
-            -
-            -
            ### 2.0
-            -
-            -
            * This plugin can now be activated for a network and a networkwide default can be set.
-            -
            * The plugin now hooks in after init to make sure any customisations to the login form are hooked in before it.
-            -
            * Links should now be fixed when SSL is enabled.
-            -
-            -
            ### 1.9
-            -
-            -
            * wp-admin will now have a `wp_die()` message instead of a 404 template because this caused problems.
-            -
            * Minimum version is now 3.8.
-            -
            * Added updates from wp-login.php in 3.8.
-            -
-            -
            ### 1.8
-            -
-            -
            * OOP PHP.
-            -
            * Requires WordPress 3.7 or higher.
-            -
            * MultiViews compatible.
-            -
-            -
            ### 1.7
-            -
-            -
            * Made compatible with WordPress 3.7.
-            -
-            -
            ### 1.6
-            -
-            -
            * Fixed the login link when `site_url()` ≠ `home_url()`.
-            -
            * Added a [mirror](https://github.com/avryl/rename-wp-login) on GitHub.
-            -
-            -
            ### 1.5
-            -
-            -
            * Made [User Switching](http://wordpress.org/plugins/user-switching/) compatible.
-            -
-            -
            ### 1.4
-            -
-            -
            * Faster page load.
-            -
            * Fixed 404 error for permalink structures with a prefixed path. “Almost pretty” permalinks work now too.
-            -
            * Code clean-up.
-            -
-            -
            ### 1.3
-            -
-            -
            * Prevents the plugin from working when there is no permalink structure.
-            -
-            -
            ### 1.2
-            -
-            -
            * Fixed status code custom login page.
-            -
-            -
            ### 1.1
-            -
-            -
            * Blocked access to wp-admin to prevent a redirect the the new login page.
-            -
-            -
            ### 1.0
-            -
-            -
            * Initial version.

readme.txt CHANGED Viewed

	@@ -4,8 +4,8 @@ Contributors: avryl
4	Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=49WXVSPP2HUKG
5	Tags: rename, login, wp-login, wp-login.php, brute force attacks, custom login url, security
6	Requires at least: 3.8
7	- Tested up to: 3.~~8.1~~
8	- Stable tag: 2.~~2.7~~
9	License: GPLv2 or later
10	License URI: http://www.gnu.org/licenses/gpl-2.0.html
11
	@@ -58,8 +58,15 @@ This plugin has a [mirror](https://github.com/avryl/rename-wp-login) on GitHub.
58
59	Either go to your MySQL database and look for the value of `rwl_page` in the options table, or remove the `rename-wp-login` folder from your `plugins` folder, log in through wp-login.php and reinstall the plugin.
60


61	== Changelog ==
62





63	= 2.2.4 =
64
65	* Fixed SSL issues.


4	Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=49WXVSPP2HUKG
5	Tags: rename, login, wp-login, wp-login.php, brute force attacks, custom login url, security
6	Requires at least: 3.8
7	+ Tested up to: 3.9
8	+ Stable tag: 2.3
9	License: GPLv2 or later
10	License URI: http://www.gnu.org/licenses/gpl-2.0.html
11

58
59	Either go to your MySQL database and look for the value of `rwl_page` in the options table, or remove the `rename-wp-login` folder from your `plugins` folder, log in through wp-login.php and reinstall the plugin.
60
61	+ On a multisite install the `rwl_page` option will be in the sitemeta table, if there is no such option in the options table.
62	+
63	== Changelog ==
64
65	+ = 2.3 =
66	+
67	+ * WordPress 3.9 compatible.
68	+ * Fix issue where the slug reverts to default when saving the permalink structure.
69	+
70	= 2.2.4 =
71
72	* Fixed SSL issues.

rename-wp-login.php CHANGED Viewed

	@@ -6,7 +6,7 @@ Plugin URI: http://wordpress.org/plugins/rename-wp-login/
6	Description: Change wp-login.php to whatever you want. It can also prevent a lot of brute force attacks.
7	Author: avryl
8	Author URI: http://profiles.wordpress.org/avryl/
9	- Version: 2.~~2.7~~
10	Text Domain: rename-wp-login
11	License: GPLv2 or later
12	License URI: http://www.gnu.org/licenses/gpl-2.0.html
	@@ -124,7 +124,7 @@ if ( defined( 'ABSPATH' )
124	if ( is_multisite()
125	&& ! function_exists( 'is_plugin_active_for_network' ) ) {
126
127	- require_once( ABSPATH . '/wp-admin/includes/plugin.php' );
128
129	}
130
	@@ -257,7 +257,7 @@ if ( defined( 'ABSPATH' )
257	&& strpos( $rwl_page, 'wp-login' ) === false
258	&& ! in_array( $rwl_page, $this->forbidden_slugs() ) ) {
259
260	- if ( $rwl_page === get_site_option( 'rwl_page', 'login' ) ) {
261
262	delete_option( 'rwl_page' );
263
	@@ -489,10 +489,23 @@ if ( defined( 'ABSPATH' )
489
490	elseif ( $pagenow === 'wp-login.php' ) {
491
492	- ~~require_once(~~ $~~this->path() . 'rwl-login.php' )~~;
493
494	- ~~die~~;








495





496
497	}
498


6	Description: Change wp-login.php to whatever you want. It can also prevent a lot of brute force attacks.
7	Author: avryl
8	Author URI: http://profiles.wordpress.org/avryl/
9	+ Version: 2.3
10	Text Domain: rename-wp-login
11	License: GPLv2 or later
12	License URI: http://www.gnu.org/licenses/gpl-2.0.html

124	if ( is_multisite()
125	&& ! function_exists( 'is_plugin_active_for_network' ) ) {
126
127	+ require_once( ABSPATH . '/wp-admin/includes/plugin.php' );
128
129	}
130

257	&& strpos( $rwl_page, 'wp-login' ) === false
258	&& ! in_array( $rwl_page, $this->forbidden_slugs() ) ) {
259
260	+ if ( is_multisite() && $rwl_page === get_site_option( 'rwl_page', 'login' ) ) {
261
262	delete_option( 'rwl_page' );
263

489
490	elseif ( $pagenow === 'wp-login.php' ) {
491
492	+ global $wp_version;
493
494	+ $version = explode( '.', $wp_version );
495	+ $major = $version[0];
496	+ $minor = $version[1];
497	+
498	+ if ( file_exists( $this->path() . 'rwl-login-' . $major . '.' . $minor . '.php' ) ) {
499	+
500	+ require_once( $this->path() . 'rwl-login-' . $major . '.' . $minor . '.php' );
501	+
502	+ } else {
503
504	+ require_once( $this->path() . 'rwl-login-3.9.php' );
505	+
506	+ }
507	+
508	+ die;
509
510	}
511

rwl-login.php → rwl-login-3.8.php RENAMED Viewed

File without changes

rwl-login-3.9.php ADDED Viewed

	@@ -0,0 +1,938 @@


1	+ <?php
2	+ /**
3	+ * WordPress User Page
4	+ *
5	+ * Handles authentication, registering, resetting passwords, forgot password,
6	+ * and other user handling.
7	+ *
8	+ * @package WordPress
9	+ */
10	+
11	+ /** Make sure that the WordPress bootstrap has run before continuing. */
12	+ //require( dirname(__FILE__) . '/wp-load.php' );
13	+
14	+ global $error, $interim_login, $action, $user_login;
15	+
16	+ // Redirect to https login if forced to use SSL
17	+ if ( force_ssl_admin() && ! is_ssl() ) {
18	+ if ( 0 === strpos($_SERVER['REQUEST_URI'], 'http') ) {
19	+ wp_redirect( set_url_scheme( $_SERVER['REQUEST_URI'], 'https' ) );
20	+ exit();
21	+ } else {
22	+ wp_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
23	+ exit();
24	+ }
25	+ }
26	+
27	+ /**
28	+ * Output the login page header.
29	+ *
30	+ * @param string $title Optional. WordPress Log In Page title to display in <title/> element. Default 'Log In'.
31	+ * @param string $message Optional. Message to display in header. Default empty.
32	+ * @param string $wp_error Optional. The error to pass. Default empty.
33	+ * @param WP_Error $wp_error Optional. WordPress Error Object
34	+ */
35	+ function login_header( $title = 'Log In', $message = '', $wp_error = '' ) {
36	+ global $error, $interim_login, $action;
37	+
38	+ // Don't index any of these forms
39	+ add_action( 'login_head', 'wp_no_robots' );
40	+
41	+ if ( wp_is_mobile() )
42	+ add_action( 'login_head', 'wp_login_viewport_meta' );
43	+
44	+ if ( empty($wp_error) )
45	+ $wp_error = new WP_Error();
46	+
47	+ // Shake it!
48	+ $shake_error_codes = array( 'empty_password', 'empty_email', 'invalid_email', 'invalidcombo', 'empty_username', 'invalid_username', 'incorrect_password' );
49	+ /**
50	+ * Filter the error codes array for shaking the login form.
51	+ *
52	+ * @since 3.0.0
53	+ *
54	+ * @param array $shake_error_codes Error codes that shake the login form.
55	+ */
56	+ $shake_error_codes = apply_filters( 'shake_error_codes', $shake_error_codes );
57	+
58	+ if ( $shake_error_codes && $wp_error->get_error_code() && in_array( $wp_error->get_error_code(), $shake_error_codes ) )
59	+ add_action( 'login_head', 'wp_shake_js', 12 );
60	+
61	+ ?><!DOCTYPE html>
62	+ <!--[if IE 8]>
63	+ <html xmlns="http://www.w3.org/1999/xhtml" class="ie8" <?php language_attributes(); ?>>
64	+ <![endif]-->
65	+ <!--[if !(IE 8) ]><!-->
66	+ <html xmlns="http://www.w3.org/1999/xhtml" <?php language_attributes(); ?>>
67	+ <!--<![endif]-->
68	+ <head>
69	+ <meta http-equiv="Content-Type" content="<?php bloginfo('html_type'); ?>; charset=<?php bloginfo('charset'); ?>" />
70	+ <title><?php bloginfo('name'); ?> &rsaquo; <?php echo $title; ?></title>
71	+ <?php
72	+
73	+ wp_admin_css( 'login', true );
74	+
75	+ // Remove all stored post data on logging out.
76	+ // This could be added by add_action('login_head'...) like wp_shake_js()
77	+ // but maybe better if it's not removable by plugins
78	+ if ( 'loggedout' == $wp_error->get_error_code() ) {
79	+ ?>
80	+ <script>if("sessionStorage" in window){try{for(var key in sessionStorage){if(key.indexOf("wp-autosave-")!=-1){sessionStorage.removeItem(key)}}}catch(e){}};</script>
81	+ <?php
82	+ }
83	+
84	+ /**
85	+ * Enqueue scripts and styles for the login page.
86	+ *
87	+ * @since 3.1.0
88	+ */
89	+ do_action( 'login_enqueue_scripts' );
90	+ /**
91	+ * Fires in the login page header after scripts are enqueued.
92	+ *
93	+ * @since 2.1.0
94	+ */
95	+ do_action( 'login_head' );
96	+
97	+ if ( is_multisite() ) {
98	+ $login_header_url = network_home_url();
99	+ $login_header_title = get_current_site()->site_name;
100	+ } else {
101	+ $login_header_url = __( 'https://wordpress.org/' );
102	+ $login_header_title = __( 'Powered by WordPress' );
103	+ }
104	+
105	+ /**
106	+ * Filter link URL of the header logo above login form.
107	+ *
108	+ * @since 2.1.0
109	+ *
110	+ * @param string $login_header_url Login header logo URL.
111	+ */
112	+ $login_header_url = apply_filters( 'login_headerurl', $login_header_url );
113	+ /**
114	+ * Filter the title attribute of the header logo above login form.
115	+ *
116	+ * @since 2.1.0
117	+ *
118	+ * @param string $login_header_title Login header logo title attribute.
119	+ */
120	+ $login_header_title = apply_filters( 'login_headertitle', $login_header_title );
121	+
122	+ $classes = array( 'login-action-' . $action, 'wp-core-ui' );
123	+ if ( wp_is_mobile() )
124	+ $classes[] = 'mobile';
125	+ if ( is_rtl() )
126	+ $classes[] = 'rtl';
127	+ if ( $interim_login ) {
128	+ $classes[] = 'interim-login';
129	+ ?>
130	+ <style type="text/css">html{background-color: transparent;}</style>
131	+ <?php
132	+
133	+ if ( 'success' === $interim_login )
134	+ $classes[] = 'interim-login-success';
135	+ }
136	+
137	+ /**
138	+ * Filter the login page body classes.
139	+ *
140	+ * @since 3.5.0
141	+ *
142	+ * @param array $classes An array of body classes.
143	+ * @param string $action The action that brought the visitor to the login page.
144	+ */
145	+ $classes = apply_filters( 'login_body_class', $classes, $action );
146	+
147	+ ?>
148	+ </head>
149	+ <body class="login <?php echo esc_attr( implode( ' ', $classes ) ); ?>">
150	+ <div id="login">
151	+ <h1><a href="<?php echo esc_url( $login_header_url ); ?>" title="<?php echo esc_attr( $login_header_title ); ?>"><?php bloginfo( 'name' ); ?></a></h1>
152	+ <?php
153	+
154	+ unset( $login_header_url, $login_header_title );
155	+
156	+ /**
157	+ * Filter the message to display above the login form.
158	+ *
159	+ * @since 2.1.0
160	+ *
161	+ * @param string $message Login message text.
162	+ */
163	+ $message = apply_filters( 'login_message', $message );
164	+ if ( !empty( $message ) )
165	+ echo $message . "\n";
166	+
167	+ // In case a plugin uses $error rather than the $wp_errors object
168	+ if ( !empty( $error ) ) {
169	+ $wp_error->add('error', $error);
170	+ unset($error);
171	+ }
172	+
173	+ if ( $wp_error->get_error_code() ) {
174	+ $errors = '';
175	+ $messages = '';
176	+ foreach ( $wp_error->get_error_codes() as $code ) {
177	+ $severity = $wp_error->get_error_data($code);
178	+ foreach ( $wp_error->get_error_messages($code) as $error ) {
179	+ if ( 'message' == $severity )
180	+ $messages .= ' ' . $error . "<br />\n";
181	+ else
182	+ $errors .= ' ' . $error . "<br />\n";
183	+ }
184	+ }
185	+ if ( ! empty( $errors ) ) {
186	+ /**
187	+ * Filter the error messages displayed above the login form.
188	+ *
189	+ * @since 2.1.0
190	+ *
191	+ * @param string $errors Login error message.
192	+ */
193	+ echo '<div id="login_error">' . apply_filters( 'login_errors', $errors ) . "</div>\n";
194	+ }
195	+ if ( ! empty( $messages ) ) {
196	+ /**
197	+ * Filter instructional messages displayed above the login form.
198	+ *
199	+ * @since 2.5.0
200	+ *
201	+ * @param string $messages Login messages.
202	+ */
203	+ echo '<p class="message">' . apply_filters( 'login_messages', $messages ) . "</p>\n";
204	+ }
205	+ }
206	+ } // End of login_header()
207	+
208	+ /**
209	+ * Outputs the footer for the login page.
210	+ *
211	+ * @param string $input_id Which input to auto-focus
212	+ */
213	+ function login_footer($input_id = '') {
214	+ global $interim_login;
215	+
216	+ // Don't allow interim logins to navigate away from the page.
217	+ if ( ! $interim_login ): ?>
218	+ <p id="backtoblog"><a href="<?php echo esc_url( home_url( '/' ) ); ?>" title="<?php esc_attr_e( 'Are you lost?' ); ?>"><?php printf( __( '← Back to %s' ), get_bloginfo( 'title', 'display' ) ); ?></a></p>
219	+ <?php endif; ?>
220	+
221	+ </div>
222	+
223	+ <?php if ( !empty($input_id) ) : ?>
224	+ <script type="text/javascript">
225	+ try{document.getElementById('<?php echo $input_id; ?>').focus();}catch(e){}
226	+ if(typeof wpOnload=='function')wpOnload();
227	+ </script>
228	+ <?php endif; ?>
229	+
230	+ <?php
231	+ /**
232	+ * Fires in the login page footer.
233	+ *
234	+ * @since 3.1.0
235	+ */
236	+ do_action( 'login_footer' ); ?>
237	+ <div class="clear"></div>
238	+ </body>
239	+ </html>
240	+ <?php
241	+ }
242	+
243	+ function wp_shake_js() {
244	+ if ( wp_is_mobile() )
245	+ return;
246	+ ?>
247	+ <script type="text/javascript">
248	+ addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
249	+ function s(id,pos){g(id).left=pos+'px';}
250	+ function g(id){return document.getElementById(id).style;}
251	+ function shake(id,a,d){c=a.shift();s(id,c);if(a.length>0){setTimeout(function(){shake(id,a,d);},d);}else{try{g(id).position='static';wp_attempt_focus();}catch(e){}}}
252	+ addLoadEvent(function(){ var p=new Array(15,30,15,0,-15,-30,-15,0);p=p.concat(p.concat(p));var i=document.forms[0].id;g(i).position='relative';shake(i,p,20);});
253	+ </script>
254	+ <?php
255	+ }
256	+
257	+ function wp_login_viewport_meta() {
258	+ ?>
259	+ <meta name="viewport" content="width=device-width" />
260	+ <?php
261	+ }
262	+
263	+ /**
264	+ * Handles sending password retrieval email to user.
265	+ *
266	+ * @uses $wpdb WordPress Database object
267	+ *
268	+ * @return bool\|WP_Error True: when finish. WP_Error on error
269	+ */
270	+ function retrieve_password() {
271	+ global $wpdb, $wp_hasher;
272	+
273	+ $errors = new WP_Error();
274	+
275	+ if ( empty( $_POST['user_login'] ) ) {
276	+ $errors->add('empty_username', __('<strong>ERROR</strong>: Enter a username or e-mail address.'));
277	+ } else if ( strpos( $_POST['user_login'], '@' ) ) {
278	+ $user_data = get_user_by( 'email', trim( $_POST['user_login'] ) );
279	+ if ( empty( $user_data ) )
280	+ $errors->add('invalid_email', __('<strong>ERROR</strong>: There is no user registered with that email address.'));
281	+ } else {
282	+ $login = trim($_POST['user_login']);
283	+ $user_data = get_user_by('login', $login);
284	+ }
285	+
286	+ /**
287	+ * Fires before errors are returned from a password reset request.
288	+ *
289	+ * @since 2.1.0
290	+ */
291	+ do_action( 'lostpassword_post' );
292	+
293	+ if ( $errors->get_error_code() )
294	+ return $errors;
295	+
296	+ if ( !$user_data ) {
297	+ $errors->add('invalidcombo', __('<strong>ERROR</strong>: Invalid username or e-mail.'));
298	+ return $errors;
299	+ }
300	+
301	+ // redefining user_login ensures we return the right case in the email
302	+ $user_login = $user_data->user_login;
303	+ $user_email = $user_data->user_email;
304	+
305	+ /**
306	+ * Fires before a new password is retrieved.
307	+ *
308	+ * @since 1.5.0
309	+ * @deprecated 1.5.1 Misspelled. Use 'retrieve_password' hook instead.
310	+ *
311	+ * @param string $user_login The user login name.
312	+ */
313	+ do_action( 'retreive_password', $user_login );
314	+ /**
315	+ * Fires before a new password is retrieved.
316	+ *
317	+ * @since 1.5.1
318	+ *
319	+ * @param string $user_login The user login name.
320	+ */
321	+ do_action( 'retrieve_password', $user_login );
322	+
323	+ /**
324	+ * Filter whether to allow a password to be reset.
325	+ *
326	+ * @since 2.7.0
327	+ *
328	+ * @param bool true Whether to allow the password to be reset. Default true.
329	+ * @param int $user_data->ID The ID of the user attempting to reset a password.
330	+ */
331	+ $allow = apply_filters( 'allow_password_reset', true, $user_data->ID );
332	+
333	+ if ( ! $allow )
334	+ return new WP_Error('no_password_reset', __('Password reset is not allowed for this user'));
335	+ else if ( is_wp_error($allow) )
336	+ return $allow;
337	+
338	+ // Generate something random for a password reset key.
339	+ $key = wp_generate_password( 20, false );
340	+
341	+ /**
342	+ * Fires when a password reset key is generated.
343	+ *
344	+ * @since 2.5.0
345	+ *
346	+ * @param string $user_login The username for the user.
347	+ * @param string $key The generated password reset key.
348	+ */
349	+ do_action( 'retrieve_password_key', $user_login, $key );
350	+
351	+ // Now insert the key, hashed, into the DB.
352	+ if ( empty( $wp_hasher ) ) {
353	+ require_once ABSPATH . 'wp-includes/class-phpass.php';
354	+ $wp_hasher = new PasswordHash( 8, true );
355	+ }
356	+ $hashed = $wp_hasher->HashPassword( $key );
357	+ $wpdb->update( $wpdb->users, array( 'user_activation_key' => $hashed ), array( 'user_login' => $user_login ) );
358	+
359	+ $message = __('Someone requested that the password be reset for the following account:') . "\r\n\r\n";
360	+ $message .= network_home_url( '/' ) . "\r\n\r\n";
361	+ $message .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n";
362	+ $message .= __('If this was a mistake, just ignore this email and nothing will happen.') . "\r\n\r\n";
363	+ $message .= __('To reset your password, visit the following address:') . "\r\n\r\n";
364	+ $message .= '<' . network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . ">\r\n";
365	+
366	+ if ( is_multisite() )
367	+ $blogname = $GLOBALS['current_site']->site_name;
368	+ else
369	+ // The blogname option is escaped with esc_html on the way into the database in sanitize_option
370	+ // we want to reverse this for the plain text arena of emails.
371	+ $blogname = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES);
372	+
373	+ $title = sprintf( __('[%s] Password Reset'), $blogname );
374	+
375	+ /**
376	+ * Filter the subject of the password reset email.
377	+ *
378	+ * @since 2.8.0
379	+ *
380	+ * @param string $title Default email title.
381	+ */
382	+ $title = apply_filters( 'retrieve_password_title', $title );
383	+ /**
384	+ * Filter the message body of the password reset mail.
385	+ *
386	+ * @since 2.8.0
387	+ *
388	+ * @param string $message Default mail message.
389	+ * @param string $key The activation key.
390	+ */
391	+ $message = apply_filters( 'retrieve_password_message', $message, $key );
392	+
393	+ if ( $message && !wp_mail($user_email, $title, $message) )
394	+ wp_die( __('The e-mail could not be sent.') . "<br />\n" . __('Possible reason: your host may have disabled the mail() function.') );
395	+
396	+ return true;
397	+ }
398	+
399	+ //
400	+ // Main
401	+ //
402	+
403	+ $action = isset($_REQUEST['action']) ? $_REQUEST['action'] : 'login';
404	+ $errors = new WP_Error();
405	+
406	+ if ( isset($_GET['key']) )
407	+ $action = 'resetpass';
408	+
409	+ // validate action so as to default to the login screen
410	+ if ( !in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login' ), true ) && false === has_filter( 'login_form_' . $action ) )
411	+ $action = 'login';
412	+
413	+ nocache_headers();
414	+
415	+ header('Content-Type: '.get_bloginfo('html_type').'; charset='.get_bloginfo('charset'));
416	+
417	+ if ( defined( 'RELOCATE' ) && RELOCATE ) { // Move flag is set
418	+ if ( isset( $_SERVER['PATH_INFO'] ) && ($_SERVER['PATH_INFO'] != $_SERVER['PHP_SELF']) )
419	+ $_SERVER['PHP_SELF'] = str_replace( $_SERVER['PATH_INFO'], '', $_SERVER['PHP_SELF'] );
420	+
421	+ $url = dirname( set_url_scheme( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] ) );
422	+ if ( $url != get_option( 'siteurl' ) )
423	+ update_option( 'siteurl', $url );
424	+ }
425	+
426	+ //Set a cookie now to see if they are supported by the browser.
427	+ setcookie(TEST_COOKIE, 'WP Cookie check', 0, COOKIEPATH, COOKIE_DOMAIN);
428	+ if ( SITECOOKIEPATH != COOKIEPATH )
429	+ setcookie(TEST_COOKIE, 'WP Cookie check', 0, SITECOOKIEPATH, COOKIE_DOMAIN);
430	+
431	+ /**
432	+ * Fires when the login form is initialized.
433	+ *
434	+ * @since 3.2.0
435	+ */
436	+ do_action( 'login_init' );
437	+ /**
438	+ * Fires before a specified login form action.
439	+ *
440	+ * The dynamic portion of the hook name, $action, refers to the action
441	+ * that brought the visitor to the login form. Actions include 'postpass',
442	+ * 'logout', 'lostpassword', etc.
443	+ *
444	+ * @since 2.8.0
445	+ */
446	+ do_action( 'login_form_' . $action );
447	+
448	+ $http_post = ('POST' == $_SERVER['REQUEST_METHOD']);
449	+ $interim_login = isset($_REQUEST['interim-login']);
450	+
451	+ switch ($action) {
452	+
453	+ case 'postpass' :
454	+ require_once ABSPATH . 'wp-includes/class-phpass.php';
455	+ $hasher = new PasswordHash( 8, true );
456	+
457	+ /**
458	+ * Filter the life span of the post password cookie.
459	+ *
460	+ * By default, the cookie expires 10 days from creation. To turn this
461	+ * into a session cookie, return 0.
462	+ *
463	+ * @since 3.7.0
464	+ *
465	+ * @param int $expires The expiry time, as passed to setcookie().
466	+ */
467	+ $expire = apply_filters( 'post_password_expires', time() + 10 * DAY_IN_SECONDS );
468	+ setcookie( 'wp-postpass_' . COOKIEHASH, $hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ), $expire, COOKIEPATH );
469	+
470	+ wp_safe_redirect( wp_get_referer() );
471	+ exit();
472	+
473	+ break;
474	+
475	+ case 'logout' :
476	+ check_admin_referer('log-out');
477	+ wp_logout();
478	+
479	+ $redirect_to = !empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : 'wp-login.php?loggedout=true';
480	+ wp_safe_redirect( $redirect_to );
481	+ exit();
482	+
483	+ break;
484	+
485	+ case 'lostpassword' :
486	+ case 'retrievepassword' :
487	+
488	+ if ( $http_post ) {
489	+ $errors = retrieve_password();
490	+ if ( !is_wp_error($errors) ) {
491	+ $redirect_to = !empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : 'wp-login.php?checkemail=confirm';
492	+ wp_safe_redirect( $redirect_to );
493	+ exit();
494	+ }
495	+ }
496	+
497	+ if ( isset( $_GET['error'] ) ) {
498	+ if ( 'invalidkey' == $_GET['error'] )
499	+ $errors->add( 'invalidkey', __( 'Sorry, that key does not appear to be valid.' ) );
500	+ elseif ( 'expiredkey' == $_GET['error'] )
501	+ $errors->add( 'expiredkey', __( 'Sorry, that key has expired. Please try again.' ) );
502	+ }
503	+
504	+ $lostpassword_redirect = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
505	+ /**
506	+ * Filter the URL redirected to after submitting the lostpassword/retrievepassword form.
507	+ *
508	+ * @since 3.0.0
509	+ *
510	+ * @param string $lostpassword_redirect The redirect destination URL.
511	+ */
512	+ $redirect_to = apply_filters( 'lostpassword_redirect', $lostpassword_redirect );
513	+
514	+ /**
515	+ * Fires before the lost password form.
516	+ *
517	+ * @since 1.5.1
518	+ */
519	+ do_action( 'lost_password' );
520	+
521	+ login_header(__('Lost Password'), '<p class="message">' . __('Please enter your username or email address. You will receive a link to create a new password via email.') . '</p>', $errors);
522	+
523	+ $user_login = isset($_POST['user_login']) ? wp_unslash($_POST['user_login']) : '';
524	+
525	+ ?>
526	+
527	+ <form name="lostpasswordform" id="lostpasswordform" action="<?php echo esc_url( site_url( 'wp-login.php?action=lostpassword', 'login_post' ) ); ?>" method="post">
528	+ <p>
529	+ <label for="user_login" ><?php _e('Username or E-mail:') ?><br />
530	+ <input type="text" name="user_login" id="user_login" class="input" value="<?php echo esc_attr($user_login); ?>" size="20" /></label>
531	+ </p>
532	+ <?php
533	+ /**
534	+ * Fires inside the lostpassword <form> tags, before the hidden fields.
535	+ *
536	+ * @since 2.1.0
537	+ */
538	+ do_action( 'lostpassword_form' ); ?>
539	+ <input type="hidden" name="redirect_to" value="<?php echo esc_attr( $redirect_to ); ?>" />
540	+ <p class="submit"><input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e('Get New Password'); ?>" /></p>
541	+ </form>
542	+
543	+ <p id="nav">
544	+ <a href="<?php echo esc_url( wp_login_url() ); ?>"><?php _e('Log in') ?></a>
545	+ <?php
546	+ if ( get_option( 'users_can_register' ) ) :
547	+ $registration_url = sprintf( '<a href="%s">%s</a>', esc_url( wp_registration_url() ), __( 'Register' ) );
548	+ /**
549	+ * Filter the registration URL below the login form.
550	+ *
551	+ * @since 1.5.0
552	+ *
553	+ * @param string $registration_url Registration URL.
554	+ */
555	+ echo ' \| ' . apply_filters( 'register', $registration_url );
556	+ endif;
557	+ ?>
558	+ </p>
559	+
560	+ <?php
561	+ login_footer('user_login');
562	+ break;
563	+
564	+ case 'resetpass' :
565	+ case 'rp' :
566	+ $user = check_password_reset_key($_GET['key'], $_GET['login']);
567	+
568	+ if ( is_wp_error($user) ) {
569	+ if ( $user->get_error_code() === 'expired_key' )
570	+ wp_redirect( site_url( 'wp-login.php?action=lostpassword&error=expiredkey' ) );
571	+ else
572	+ wp_redirect( site_url( 'wp-login.php?action=lostpassword&error=invalidkey' ) );
573	+ exit;
574	+ }
575	+
576	+ $errors = new WP_Error();
577	+
578	+ if ( isset($_POST['pass1']) && $_POST['pass1'] != $_POST['pass2'] )
579	+ $errors->add( 'password_reset_mismatch', __( 'The passwords do not match.' ) );
580	+
581	+ /**
582	+ * Fires before the password reset procedure is validated.
583	+ *
584	+ * @since 3.5.0
585	+ *
586	+ * @param object $errors WP Error object.
587	+ * @param WP_User\|WP_Error $user WP_User object if the login and reset key match. WP_Error object otherwise.
588	+ */
589	+ do_action( 'validate_password_reset', $errors, $user );
590	+
591	+ if ( ( ! $errors->get_error_code() ) && isset( $_POST['pass1'] ) && !empty( $_POST['pass1'] ) ) {
592	+ reset_password($user, $_POST['pass1']);
593	+ login_header( __( 'Password Reset' ), '<p class="message reset-pass">' . __( 'Your password has been reset.' ) . ' <a href="' . esc_url( wp_login_url() ) . '">' . __( 'Log in' ) . '</a></p>' );
594	+ login_footer();
595	+ exit;
596	+ }
597	+
598	+ wp_enqueue_script('utils');
599	+ wp_enqueue_script('user-profile');
600	+
601	+ login_header(__('Reset Password'), '<p class="message reset-pass">' . __('Enter your new password below.') . '</p>', $errors );
602	+
603	+ ?>
604	+ <form name="resetpassform" id="resetpassform" action="<?php echo esc_url( site_url( 'wp-login.php?action=resetpass&key=' . urlencode( $_GET['key'] ) . '&login=' . urlencode( $_GET['login'] ), 'login_post' ) ); ?>" method="post" autocomplete="off">
605	+ <input type="hidden" id="user_login" value="<?php echo esc_attr( $_GET['login'] ); ?>" autocomplete="off" />
606	+
607	+ <p>
608	+ <label for="pass1"><?php _e('New password') ?><br />
609	+ <input type="password" name="pass1" id="pass1" class="input" size="20" value="" autocomplete="off" /></label>
610	+ </p>
611	+ <p>
612	+ <label for="pass2"><?php _e('Confirm new password') ?><br />
613	+ <input type="password" name="pass2" id="pass2" class="input" size="20" value="" autocomplete="off" /></label>
614	+ </p>
615	+
616	+ <div id="pass-strength-result" class="hide-if-no-js"><?php _e('Strength indicator'); ?></div>
617	+ <p class="description indicator-hint"><?php _e('Hint: The password should be at least seven characters long. To make it stronger, use upper and lower case letters, numbers, and symbols like ! " ? $ % ^ & ).'); ?></p>
618	+
619	+ <br class="clear" />
620	+
621	+ <?php
622	+ /**
623	+ * Fires following the 'Strength indicator' meter in the user password reset form.
624	+ *
625	+ * @since 3.9.0
626	+ *
627	+ * @param WP_User $user User undergoing the password reset.
628	+ */
629	+ do_action( 'resetpass_form', $user );
630	+ ?>
631	+ <p class="submit"><input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e('Reset Password'); ?>" /></p>
632	+ </form>
633	+
634	+ <p id="nav">
635	+ <a href="<?php echo esc_url( wp_login_url() ); ?>"><?php _e( 'Log in' ); ?></a>
636	+ <?php
637	+ if ( get_option( 'users_can_register' ) ) :
638	+ $registration_url = sprintf( '<a href="%s">%s</a>', esc_url( wp_registration_url() ), __( 'Register' ) );
639	+ /** This filter is documented in wp-login.php */
640	+ echo ' \| ' . apply_filters( 'register', $registration_url );
641	+ endif;
642	+ ?>
643	+ </p>
644	+
645	+ <?php
646	+ login_footer('user_pass');
647	+ break;
648	+
649	+ case 'register' :
650	+ if ( is_multisite() ) {
651	+ $sign_up_url = network_site_url( 'wp-signup.php' );
652	+ /**
653	+ * Filter the Multisite sign up URL.
654	+ *
655	+ * @since 3.0.0
656	+ *
657	+ * @param string $sign_up_url The sign up URL.
658	+ */
659	+ wp_redirect( apply_filters( 'wp_signup_location', $sign_up_url ) );
660	+ exit;
661	+ }
662	+
663	+ if ( !get_option('users_can_register') ) {
664	+ wp_redirect( site_url('wp-login.php?registration=disabled') );
665	+ exit();
666	+ }
667	+
668	+ $user_login = '';
669	+ $user_email = '';
670	+ if ( $http_post ) {
671	+ $user_login = $_POST['user_login'];
672	+ $user_email = $_POST['user_email'];
673	+ $errors = register_new_user($user_login, $user_email);
674	+ if ( !is_wp_error($errors) ) {
675	+ $redirect_to = !empty( $_POST['redirect_to'] ) ? $_POST['redirect_to'] : 'wp-login.php?checkemail=registered';
676	+ wp_safe_redirect( $redirect_to );
677	+ exit();
678	+ }
679	+ }
680	+
681	+ $registration_redirect = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
682	+ /**
683	+ * Filter the registration redirect URL.
684	+ *
685	+ * @since 3.0.0
686	+ *
687	+ * @param string $registration_redirect The redirect destination URL.
688	+ */
689	+ $redirect_to = apply_filters( 'registration_redirect', $registration_redirect );
690	+ login_header(__('Registration Form'), '<p class="message register">' . __('Register For This Site') . '</p>', $errors);
691	+ ?>
692	+
693	+ <form name="registerform" id="registerform" action="<?php echo esc_url( site_url('wp-login.php?action=register', 'login_post') ); ?>" method="post">
694	+ <p>
695	+ <label for="user_login"><?php _e('Username') ?><br />
696	+ <input type="text" name="user_login" id="user_login" class="input" value="<?php echo esc_attr(wp_unslash($user_login)); ?>" size="20" /></label>
697	+ </p>
698	+ <p>
699	+ <label for="user_email"><?php _e('E-mail') ?><br />
700	+ <input type="text" name="user_email" id="user_email" class="input" value="<?php echo esc_attr(wp_unslash($user_email)); ?>" size="25" /></label>
701	+ </p>
702	+ <?php
703	+ /**
704	+ * Fires following the 'E-mail' field in the user registration form.
705	+ *
706	+ * @since 2.1.0
707	+ */
708	+ do_action( 'register_form' );
709	+ ?>
710	+ <p id="reg_passmail"><?php _e('A password will be e-mailed to you.') ?></p>
711	+ <br class="clear" />
712	+ <input type="hidden" name="redirect_to" value="<?php echo esc_attr( $redirect_to ); ?>" />
713	+ <p class="submit"><input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e('Register'); ?>" /></p>
714	+ </form>
715	+
716	+ <p id="nav">
717	+ <a href="<?php echo esc_url( wp_login_url() ); ?>"><?php _e( 'Log in' ); ?></a> \|
718	+ <a href="<?php echo esc_url( wp_lostpassword_url() ); ?>" title="<?php esc_attr_e( 'Password Lost and Found' ) ?>"><?php _e( 'Lost your password?' ); ?></a>
719	+ </p>
720	+
721	+ <?php
722	+ login_footer('user_login');
723	+ break;
724	+
725	+ case 'login' :
726	+ default:
727	+ $secure_cookie = '';
728	+ $customize_login = isset( $_REQUEST['customize-login'] );
729	+ if ( $customize_login )
730	+ wp_enqueue_script( 'customize-base' );
731	+
732	+ // If the user wants ssl but the session is not ssl, force a secure cookie.
733	+ if ( !empty($_POST['log']) && !force_ssl_admin() ) {
734	+ $user_name = sanitize_user($_POST['log']);
735	+ if ( $user = get_user_by('login', $user_name) ) {
736	+ if ( get_user_option('use_ssl', $user->ID) ) {
737	+ $secure_cookie = true;
738	+ force_ssl_admin(true);
739	+ }
740	+ }
741	+ }
742	+
743	+ if ( isset( $_REQUEST['redirect_to'] ) ) {
744	+ $redirect_to = $_REQUEST['redirect_to'];
745	+ // Redirect to https if user wants ssl
746	+ if ( $secure_cookie && false !== strpos($redirect_to, 'wp-admin') )
747	+ $redirect_to = preg_replace('\|^http://\|', 'https://', $redirect_to);
748	+ } else {
749	+ $redirect_to = admin_url();
750	+ }
751	+
752	+ $reauth = empty($_REQUEST['reauth']) ? false : true;
753	+
754	+ // If the user was redirected to a secure login form from a non-secure admin page, and secure login is required but secure admin is not, then don't use a secure
755	+ // cookie and redirect back to the referring non-secure admin page. This allows logins to always be POSTed over SSL while allowing the user to choose visiting
756	+ // the admin via http or https.
757	+ if ( !$secure_cookie && is_ssl() && force_ssl_login() && !force_ssl_admin() && ( 0 !== strpos($redirect_to, 'https') ) && ( 0 === strpos($redirect_to, 'http') ) )
758	+ $secure_cookie = false;
759	+
760	+ // If cookies are disabled we can't log in even with a valid user+pass
761	+ if ( isset($_POST['testcookie']) && empty($_COOKIE[TEST_COOKIE]) )
762	+ $user = new WP_Error('test_cookie', __("<strong>ERROR</strong>: Cookies are blocked or not supported by your browser. You must <a href='http://www.google.com/cookies.html'>enable cookies</a> to use WordPress."));
763	+ else
764	+ $user = wp_signon('', $secure_cookie);
765	+
766	+ $requested_redirect_to = isset( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
767	+ /**
768	+ * Filter the login redirect URL.
769	+ *
770	+ * @since 3.0.0
771	+ *
772	+ * @param string $redirect_to The redirect destination URL.
773	+ * @param string $requested_redirect_to The requested redirect destination URL passed as a parameter.
774	+ * @param WP_User\|WP_Error $user WP_User object if login was successful, WP_Error object otherwise.
775	+ */
776	+ $redirect_to = apply_filters( 'login_redirect', $redirect_to, $requested_redirect_to, $user );
777	+
778	+ if ( !is_wp_error($user) && !$reauth ) {
779	+ if ( $interim_login ) {
780	+ $message = '<p class="message">' . __('You have logged in successfully.') . '</p>';
781	+ $interim_login = 'success';
782	+ login_header( '', $message ); ?>
783	+ </div>
784	+ <?php
785	+ /** This action is documented in wp-login.php */
786	+ do_action( 'login_footer' ); ?>
787	+ <?php if ( $customize_login ) : ?>
788	+ <script type="text/javascript">setTimeout( function(){ new wp.customize.Messenger({ url: '<?php echo wp_customize_url(); ?>', channel: 'login' }).send('login') }, 1000 );</script>
789	+ <?php endif; ?>
790	+ </body></html>
791	+ <?php exit;
792	+ }
793	+
794	+ if ( ( empty( $redirect_to ) \|\| $redirect_to == 'wp-admin/' \|\| $redirect_to == admin_url() ) ) {
795	+ // If the user doesn't belong to a blog, send them to user admin. If the user can't edit posts, send them to their profile.
796	+ if ( is_multisite() && !get_active_blog_for_user($user->ID) && !is_super_admin( $user->ID ) )
797	+ $redirect_to = user_admin_url();
798	+ elseif ( is_multisite() && !$user->has_cap('read') )
799	+ $redirect_to = get_dashboard_url( $user->ID );
800	+ elseif ( !$user->has_cap('edit_posts') )
801	+ $redirect_to = admin_url('profile.php');
802	+ }
803	+ wp_safe_redirect($redirect_to);
804	+ exit();
805	+ }
806	+
807	+ $errors = $user;
808	+ // Clear errors if loggedout is set.
809	+ if ( !empty($_GET['loggedout']) \|\| $reauth )
810	+ $errors = new WP_Error();
811	+
812	+ if ( $interim_login ) {
813	+ if ( ! $errors->get_error_code() )
814	+ $errors->add('expired', __('Session expired. Please log in again. You will not move away from this page.'), 'message');
815	+ } else {
816	+ // Some parts of this script use the main login form to display a message
817	+ if ( isset($_GET['loggedout']) && true == $_GET['loggedout'] )
818	+ $errors->add('loggedout', __('You are now logged out.'), 'message');
819	+ elseif ( isset($_GET['registration']) && 'disabled' == $_GET['registration'] )
820	+ $errors->add('registerdisabled', __('User registration is currently not allowed.'));
821	+ elseif ( isset($_GET['checkemail']) && 'confirm' == $_GET['checkemail'] )
822	+ $errors->add('confirm', __('Check your e-mail for the confirmation link.'), 'message');
823	+ elseif ( isset($_GET['checkemail']) && 'newpass' == $_GET['checkemail'] )
824	+ $errors->add('newpass', __('Check your e-mail for your new password.'), 'message');
825	+ elseif ( isset($_GET['checkemail']) && 'registered' == $_GET['checkemail'] )
826	+ $errors->add('registered', __('Registration complete. Please check your e-mail.'), 'message');
827	+ elseif ( strpos( $redirect_to, 'about.php?updated' ) )
828	+ $errors->add('updated', __( '<strong>You have successfully updated WordPress!</strong> Please log back in to experience the awesomeness.' ), 'message' );
829	+ }
830	+
831	+ /**
832	+ * Filter the login page errors.
833	+ *
834	+ * @since 3.6.0
835	+ *
836	+ * @param object $errors WP Error object.
837	+ * @param string $redirect_to Redirect destination URL.
838	+ */
839	+ $errors = apply_filters( 'wp_login_errors', $errors, $redirect_to );
840	+
841	+ // Clear any stale cookies.
842	+ if ( $reauth )
843	+ wp_clear_auth_cookie();
844	+
845	+ login_header(__('Log In'), '', $errors);
846	+
847	+ if ( isset($_POST['log']) )
848	+ $user_login = ( 'incorrect_password' == $errors->get_error_code() \|\| 'empty_password' == $errors->get_error_code() ) ? esc_attr(wp_unslash($_POST['log'])) : '';
849	+ $rememberme = ! empty( $_POST['rememberme'] );
850	+ ?>
851	+
852	+ <form name="loginform" id="loginform" action="<?php echo esc_url( site_url( 'wp-login.php', 'login_post' ) ); ?>" method="post">
853	+ <p>
854	+ <label for="user_login"><?php _e('Username') ?><br />
855	+ <input type="text" name="log" id="user_login" class="input" value="<?php echo esc_attr($user_login); ?>" size="20" /></label>
856	+ </p>
857	+ <p>
858	+ <label for="user_pass"><?php _e('Password') ?><br />
859	+ <input type="password" name="pwd" id="user_pass" class="input" value="" size="20" /></label>
860	+ </p>
861	+ <?php
862	+ /**
863	+ * Fires following the 'Password' field in the login form.
864	+ *
865	+ * @since 2.1.0
866	+ */
867	+ do_action( 'login_form' );
868	+ ?>
869	+ <p class="forgetmenot"><label for="rememberme"><input name="rememberme" type="checkbox" id="rememberme" value="forever" <?php checked( $rememberme ); ?> /> <?php esc_attr_e('Remember Me'); ?></label></p>
870	+ <p class="submit">
871	+ <input type="submit" name="wp-submit" id="wp-submit" class="button button-primary button-large" value="<?php esc_attr_e('Log In'); ?>" />
872	+ <?php if ( $interim_login ) { ?>
873	+ <input type="hidden" name="interim-login" value="1" />
874	+ <?php } else { ?>
875	+ <input type="hidden" name="redirect_to" value="<?php echo esc_attr($redirect_to); ?>" />
876	+ <?php } ?>
877	+ <?php if ( $customize_login ) : ?>
878	+ <input type="hidden" name="customize-login" value="1" />
879	+ <?php endif; ?>
880	+ <input type="hidden" name="testcookie" value="1" />
881	+ </p>
882	+ </form>
883	+
884	+ <?php if ( ! $interim_login ) { ?>
885	+ <p id="nav">
886	+ <?php if ( ! isset( $_GET['checkemail'] ) \|\| ! in_array( $_GET['checkemail'], array( 'confirm', 'newpass' ) ) ) :
887	+ if ( get_option( 'users_can_register' ) ) :
888	+ $registration_url = sprintf( '<a href="%s">%s</a>', esc_url( wp_registration_url() ), __( 'Register' ) );
889	+ /** This filter is documented in wp-login.php */
890	+ echo apply_filters( 'register', $registration_url ) . ' \| ';
891	+ endif;
892	+ ?>
893	+ <a href="<?php echo esc_url( wp_lostpassword_url() ); ?>" title="<?php esc_attr_e( 'Password Lost and Found' ); ?>"><?php _e( 'Lost your password?' ); ?></a>
894	+ <?php endif; ?>
895	+ </p>
896	+ <?php } ?>
897	+
898	+ <script type="text/javascript">
899	+ function wp_attempt_focus(){
900	+ setTimeout( function(){ try{
901	+ <?php if ( $user_login \|\| $interim_login ) { ?>
902	+ d = document.getElementById('user_pass');
903	+ d.value = '';
904	+ <?php } else { ?>
905	+ d = document.getElementById('user_login');
906	+ <?php if ( 'invalid_username' == $errors->get_error_code() ) { ?>
907	+ if( d.value != '' )
908	+ d.value = '';
909	+ <?php
910	+ }
911	+ }?>
912	+ d.focus();
913	+ d.select();
914	+ } catch(e){}
915	+ }, 200);
916	+ }
917	+
918	+ <?php if ( !$error ) { ?>
919	+ wp_attempt_focus();
920	+ <?php } ?>
921	+ if(typeof wpOnload=='function')wpOnload();
922	+ <?php if ( $interim_login ) { ?>
923	+ (function(){
924	+ try {
925	+ var i, links = document.getElementsByTagName('a');
926	+ for ( i in links ) {
927	+ if ( links[i].href )
928	+ links[i].target = '_blank';
929	+ }
930	+ } catch(e){}
931	+ }());
932	+ <?php } ?>
933	+ </script>
934	+
935	+ <?php
936	+ login_footer();
937	+ break;
938	+ } // end action switch