tml_login_handler()

function tml_login_handler() {
    // phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing -- mirrors wp-login.php's own login-form processing, which authenticates via wp_signon()/credentials rather than a nonce.

    $errors = new WP_Error();

    $secure_cookie = '';

    // If the user wants ssl but the session is not ssl, force a secure cookie.
    if ( ! empty( $_POST['log'] ) && ! force_ssl_admin() ) {
        $user_name = sanitize_user( wp_unslash( $_POST['log'] ) );
        $user      = get_user_by( 'login', $user_name );

        if ( ! $user && strpos( $user_name, '@' ) ) {
            $user = get_user_by( 'email', $user_name );
        }

        if ( $user ) {
            if ( get_user_option( 'use_ssl', $user->ID ) ) {
                $secure_cookie = true;
                force_ssl_admin( true );
            }
        }
    }

    if ( ! empty( $_REQUEST['redirect_to'] ) ) {
        $redirect_to = $_REQUEST['redirect_to'];
        // Redirect to https if user wants ssl
        if ( $secure_cookie && false !== strpos( $redirect_to, 'wp-admin' ) ) {
            $redirect_to = preg_replace( '|^http://|', 'https://', $redirect_to );
        }
    } else {
        $redirect_to = admin_url();
    }

    $reauth = empty( $_REQUEST['reauth'] ) ? false : true;

    $user = wp_signon( array(), $secure_cookie );

    if ( empty( $_COOKIE[ LOGGED_IN_COOKIE ] ) ) {
        if ( headers_sent() ) {
            $user = new WP_Error(
                'test_cookie',
                sprintf(
                    __( '<strong>Error:</strong> Cookies are blocked due to unexpected output. For help, please see <a href="%1$s">this documentation</a> or try the <a href="%2$s">support forums</a>.' ), // phpcs:ignore WordPress.WP.I18n.MissingArgDomain, WordPress.WP.I18n.MissingTranslatorsComment -- reusing WP core's translated wp-login.php string verbatim, not a TML-specific string; no translators comment since it never enters TML's own .pot.
                    __( 'https://developer.wordpress.org/advanced-administration/wordpress/cookies/' ), // phpcs:ignore WordPress.WP.I18n.MissingArgDomain -- reusing WP core's translated wp-login.php string verbatim, not a TML-specific string.
                    __( 'https://wordpress.org/support/forums/' ) // phpcs:ignore WordPress.WP.I18n.MissingArgDomain -- reusing WP core's translated wp-login.php string verbatim, not a TML-specific string.
                )
            );
        } elseif ( isset( $_POST['testcookie'] ) && empty( $_COOKIE[ TEST_COOKIE ] ) ) {
            // If cookies are disabled we can't log in even with a valid user+pass
            $user = new WP_Error(
                'test_cookie',
                sprintf(
                    __( '<strong>Error:</strong> Cookies are blocked or not supported by your browser. You must <a href="%s">enable cookies</a> to use WordPress.' ), // phpcs:ignore WordPress.WP.I18n.MissingArgDomain, WordPress.WP.I18n.MissingTranslatorsComment -- reusing WP core's translated wp-login.php string verbatim, not a TML-specific string; no translators comment since it never enters TML's own .pot.
                    __( 'https://developer.wordpress.org/advanced-administration/wordpress/cookies/#enable-cookies-in-your-browser' ) // phpcs:ignore WordPress.WP.I18n.MissingArgDomain -- reusing WP core's translated wp-login.php string verbatim, not a TML-specific string.
                )
            );
        }
    }
    /** This filter is documented in wp-login.php */
    $redirect_to = apply_filters( 'login_redirect', $redirect_to, isset( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '', $user );

    if ( ! is_wp_error( $user ) && ! $reauth ) {

        if ( ( empty( $redirect_to ) || 'wp-admin/' === $redirect_to || admin_url() === $redirect_to ) ) {

            // If the user doesn't belong to a blog, send them to user admin. If the user can't edit posts, send them to their profile.
            if ( is_multisite() && ! get_active_blog_for_user( $user->ID ) && ! is_super_admin( $user->ID ) ) {
                $redirect_to = user_admin_url();

            } elseif ( is_multisite() && ! $user->has_cap( 'read' ) ) {
                $redirect_to = get_dashboard_url( $user->ID );

            } elseif ( ! $user->has_cap( 'edit_posts' ) ) {
                if ( tml_action_exists( 'dashboard' ) ) {
                    $redirect_to = tml_get_action_url( 'dashboard' );
                } else {
                    $redirect_to = $user->has_cap( 'read' ) ? admin_url( 'profile.php' ) : home_url();
                }
            }

            if ( tml_is_ajax_request() ) {
                tml_send_ajax_success(
                    array(
                        'redirect' => $redirect_to,
                    )
                );
            } else {
                // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- matches wp-login.php's own use of plain wp_redirect() here; $redirect_to is always internally computed by this point (admin_url()/user_admin_url()/tml_get_action_url()/home_url()), never raw user input.
                wp_redirect( $redirect_to );
                exit;
            }
        }

        if ( tml_is_ajax_request() ) {
            tml_send_ajax_success(
                array(
                    'redirect' => tml_validate_redirect( $redirect_to ),
                )
            );
        } else {
            wp_safe_redirect( $redirect_to );
            exit;
        }
    } else {
        $errors = $user;
    }

    // Clear errors if loggedout is set.
    if ( ! empty( $_GET['loggedout'] ) || $reauth ) {
        $errors = new WP_Error();
    }

    if ( empty( $_POST ) && $errors->get_error_codes() === array( 'empty_username', 'empty_password' ) ) {
        $errors = new WP_Error();
    }

    // Some parts of this script use the main login form to display a message
    // phpcs:disable WordPress.WP.I18n.MissingArgDomain, WordPress.WP.I18n.MissingTranslatorsComment -- these messages intentionally reuse WP core's translated wp-login.php strings verbatim, not TML-specific strings; no translators comments since they never enter TML's own .pot.
    if ( isset( $_GET['loggedout'] ) && $_GET['loggedout'] ) {
        $errors->add( 'loggedout', __( 'You are now logged out.' ), 'message' );

    } elseif ( isset( $_GET['registration'] ) && 'disabled' === $_GET['registration'] ) {
        $errors->add( 'registerdisabled', __( '<strong>Error:</strong> User registration is currently not allowed.' ) );

    } elseif ( isset( $_GET['checkemail'] ) && 'confirm' === $_GET['checkemail'] ) {
        $errors->add( 'confirm', sprintf( __( 'Check your email for the confirmation link, then visit the <a href="%s">login page</a>.' ), wp_login_url() ), 'message' );

    } elseif ( isset( $_GET['checkemail'] ) && 'registered' === $_GET['checkemail'] ) {
        if ( tml_allow_user_passwords() ) {
            $errors->add( 'registered', __( 'Registration complete. You may now log in.', 'theme-my-login' ), 'message' );
        } else {
            $errors->add( 'registered', sprintf( __( 'Registration complete. Please check your email, then visit the <a href="%s">login page</a>.' ), wp_login_url() ), 'message' );
        }
    } elseif ( isset( $_GET['resetpass'] ) && 'complete' === $_GET['resetpass'] ) {
        $errors->add( 'password_reset', __( 'Your password has been reset.' ), 'message' );

    } elseif ( strpos( $redirect_to, 'about.php?updated' ) ) {
        $errors->add( 'updated', __( '<strong>You have successfully updated WordPress!</strong> Please log back in to see what&#8217;s new.' ), 'message' );
    }
    // phpcs:enable WordPress.WP.I18n.MissingArgDomain

    /** This filter is documented in wp-login.php */
    $errors = apply_filters( 'wp_login_errors', $errors, $redirect_to );

    tml_set_errors( $errors );

    // Clear any stale cookies.
    if ( $reauth ) {
        wp_clear_auth_cookie();
    }

    if ( tml_is_ajax_request() ) {
        tml_send_ajax_error(
            array(
                'errors' => tml_get_form()->render_errors(),
            )
        );
    }
    // phpcs:enable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing
}

View src/includes/actions.php, line 442 on GitHub