What was the security risk? I’m asking because if you are running WordPress on an IIS 5.0 server (Windows 2000) then the regular code just won’t work. (Please don’t say use a different server.)
If you have a setcookie() command followed by a header(‘Location: ‘) directive in a php script, the cookie headers are stripped before the redirection header is sent. This bug is documented in the following knowledge base article: https://support.microsoft.com/kb/q176113/ on Microsoft’s site. I’ve made the modification to my code in wp-login.php (two places, since it does the same thing when you want to log-out) as well as in the wp-pass.php file. I haven’t found any other places where setcookie() is followed by header(‘Location:’) … does anyone else have any feedback?
