Reset password link issue

Summary:We’re having a problem where the ‘lost password’ functionality isn’t quite working as expected. This is with the latest ‘my private site’ and WP 4.3.1. All other plugins disabled. Changing the ‘Landing Location’ setting seems to fix it. More info below:

When I click on ‘Lost password’, the email comes through, we can reset everything as normal. After it resets, you’re redirected to the page:

/wp-login.php?action=resetpass

Which has the text ‘Your password has been reset. Log In’. This is all good so far. The problem I’m having is that the url the ‘Log In’ link points to has the text:

https://MYBLOG/wp-login.php?redirect_to=MYBLOG/wp-login.php?action=resetpass

(I’ve unescaped the above for sanity). So then it attempts to reset the password again, and so on ad infinitum 🙂

Changing the ‘Landing Location’ setting from the default ‘Return to same url’ to (say) ‘Site Home’ seems to fix it, but I’m a little wary of patching all the blogs we host.

Settings we’re using are pretty much stock, I think, but posted here and partly tidied up:

s:12:”private_site”;TRUE;
s:19:”reveal_registration”;TRUE
s:11:”wplogin_php”;FALSE;
s:13:”override_omit”;FALSE;
s:12:”custom_login”;FALSE;
s:19:”custom_login_onsite”;TRUE;
s:9:”excl_home”;FALSE,
s:12:”specific_url”;”;
s:7:”landing”;”return”;
s:9:”login_url”;”;
s:10:”check_role”;FALSE;
s:8:”excl_url”;array();
s:15:”excl_url_prefix”;array();

Thanks for reading this far, any advice appreciated!

https://wordpress.org/plugins/jonradio-private-site/