Well I think I found the problem (at least in my case). For some reason that I do not understand, instead of just using PHP’s $_COOKIE array, the code in check_ajax_referer is manually parsing the cookie values out from $_POST[‘cookie’]. I was so focused on the wp_login call, I was dumb and glanced right over that code.
It was fixable by replacing the code
$cookie = explode('; ', urldecode(empty($_POST['cookie']) ? $_GET['cookie'] : $_POST['cookie'])); // AJAX scripts must pass cookie=document.cookie
foreach ( $cookie as $tasty ) {
if ( false !== strpos($tasty, USER_COOKIE) )
$user = substr(strstr($tasty, '='), 1);
if ( false !== strpos($tasty, PASS_COOKIE) )
$pass = substr(strstr($tasty, '='), 1);
}
with simply
$user = $_COOKIE[USER_COOKIE];
$pass = $_COOKIE[PASS_COOKIE];
This is in wp-includes/pluggable.php, lines 244 through 251 (in the function check_ajax_referer). A warning, though: I’m not a WP Dev, or even a WP guru, so change at your own risk!
As for success, though – It worked for a few test cases that I could think of off the top of my head (adding other Administrators, deleting categories, deleting posts from the Manage page, etc). Those were the problems I was having, but it seems that this is a sporadic and problem that is pretty arbitrary… However, given that the way the manual parsing was done seems a bit unreliable, I think I could see this being the problem.
I will see about posting a bug report soon.
EDIT: I feel it important to state that I very well may have gotten this wrong, and that there’s a very good reason that code was the way it was – I cannot guarantee that the change I suggest is safe or at all a good idea. ??
