fonetik

Actually Ryan Duff appears to MIA, web wise, but there are a plethora of Contacts Form plugins by others, so I suggest using one of those.

Problem Found
At least in my case, this problem was caused by Ryan Duff’s contact form plugin (wordpress bug). The plugin uses _POST to store data for the plugin, so even when it is not an HTTP POST request, it can look like it is to WordPress.

Solution
Of course you can always fix this by simply disabling the plugin. To keep the functionality, the plugin has to be modified so that it uses normal PHP variables for storage instead of storing things in _POST. I’ll ping the plugin developer on this front.

I am seeing this same error after upgrading to WordPress 2.3.2, but only on my production server, not on my localhost machine.

After some investigation, the actual problem has something to do with the PHP _POST variable, which is one of the variables that allows access of HTTP data from Apache in PHP. Even though normal page requests show up in the Apache log as HTTP GET’s (as they should), on these requests the PHP _POST variable is set as if the request was actually an HTTP POST (which is what is used to submit a form, such as a username / password form). So to WordPress when you load wp-login.php for the first time it looks like you already had it loaded and then clicked submit with an empty username and password.

I have not figured out a resolution for the problem, but it is much more than a superficial aesthetic issue, so merely removing the lines from wp-login.php is not actually a fix.

I’m not sure how many problems this issue causes, but they are not just limited wp-login.php. I do know that the new Canonical Pretty URL rewriting in 2.3 checks requests for their type and does not attempt to rewrite URL requests that come in an HTTP POST. Since this problem makes all requests look like POSTs, it entirely disables that feature.