Scriptrunner (Doug Sparling)

More than likely. (if wp-login.php is updated)

The other thread is here: Cookie Error when Logging In

Someone had something for their functions.php (I know @willem.deboer saw it), but apparently it didn’t work.

So for now, it looks like for those effected, it’s hack a core file, revert to WordPress 3.7, or upload wp-login.php from WordPress 3.7. (it should work with WordPress 3.7.1)

I’m not on the core team, just a plugin developer and someone with clients running on WordPress. I haven’t been effected by this, but this is the kind of odd ball things that popup that I try to keep up with.

I’m curious and don’t know how it’ll be treated a sit seems to be an issue with the environment WordPress is running in. (a proxy server blocking or deleting certain cookies if that report is true)

Also, it’s up to theme and plugin authors to keep their software, which is separate from core, up-to-date and compatible with the latest releases of WordPress and different versions of PHP.

OK, I wouldn’t worry about upgrade-functions.php at the moment. It won’t be in WordPress 3.7.1, so what you have is fine.

The only thing I’ve seen in this thread (and the previous one) that makes any sense is the “headers already sent” error, as that would prevent the test cookies from being written.

As far as the cause of that error (headers already sent), it’s not necessarily wp-config.php, but often is. But it could be any php file with extra white space after the closing php tag at the end of the file. (which is why the closing php tag at the end of a file is often not used)

Once again, if it were me, I’d either delete and re-upload core files or I would just back everything up (I’d do that anyway) and do a complete fresh install (using your current wp-config.php file or copying the content over to the new one so you can use your existing database) and then bring over theme and plugins (from your old wp-content directory) over an item at a time. I’d probably go with deleting and re-uploading core files first, making sure FTP is set to automatic. If that didn’t work, then doing the complete re-install (WordPress only, not the database) might be the only way. Get a vanilla install working and then bring back in your theme and plugins. It looks like over the course of the last two or three days, you’ve made a lot of changes trying to fix things. Sometimes it might be best to start at square one and go from there.

You definitely need to eliminate the “headers already sent” error.
As far as a corrupt file from the upgrade, I just meant originally. That happens sometimes. Anyway, I’m not sure I can offer much more advice, but I don’t mind answering (or trying to 🙂 any other questions. I don’t think WordPress itself is the problem, but more likely something to do with the install or a theme/plugin compatibility issue.

First, check this codex page:
How do I solve the Headers already sent warning problem?

You mentioned you FTP’d your files in binary mode but I can’t tell from our conversation if you only uploaded wp-login.php with automatic mode, or everything. As the link above suggests, wp-config.php is often the culprit for the headers already sent error message.

Also, as there’s an notice about deprecate file wp-admin/includes/upgrade-functions.php tells me that old files weren’t deleted first when you uploaded the new ones. WordPress 3.7.1 does not include upgrade-functions.php, but I have a fresh install. However, without the deprecated upgrade-functions.php, the ss-downloads plugin will probably break. However, this shouldn’t be causing the problem, I really think that it’s related to the ‘headers already sent’ error and I’d follow that codex page. Uploading in binary very well could have caused the problem. The headers already being sent is preventing the test cookie from being set.

At this point, if it were me, I’d add a simple echo statement to check that 1) the test cookie code is being called and 2) if so, check if setcookie was successful.

In wp-login.php, right before this code (which should be line 420):

//Set a cookie now to see if they are supported by the browser.
setcookie(TEST_COOKIE, 'WP Cookie check', 0, COOKIEPATH, COOKIE_DOMAIN);
if ( SITECOOKIEPATH != COOKIEPATH )
	setcookie(TEST_COOKIE, 'WP Cookie check', 0, SITECOOKIEPATH, COOKIE_DOMAIN);

I’d add:

if (setcookie(TEST_COOKIE, 'WP Cookie check', 0, COOKIEPATH, COOKIE_DOMAIN)) {
	echo "TEST_COOKIE/COOKIE_PATH - SET";
} else {
	echo "TEST_COOKIE/COOKIE_PATH - NOT SET";
}

Actually, no, not for directories. Directories need be “executable.” Generally for WordPress, directories are 755 (drwxr-xr-x)and files are 644 (rw-r–r–).

These codex pages may help:

Changing File Permissions
Hardening WordPress

I know you’ve already tried default theme/disabling plugins (and you’ve deleted and reinstalled WordPress core files), but you might do that again with DEBUG set to true.

The first Notice I’ve seen happen from plugins using a deprecated function and also when file are FTP’d up in binary instead of ASCII.

The second notice is from a plugin, and I wouldn’t think would cause issues.

Also, you might try reuploading wp-login.php. It should set a test cookie, and from your report some cookies are getting set.