#1408 Fix - Address Copilot review: document meta auth_callback signature and drop dead AJAX-login code

Author: MILAN88888

includes/functions-ur-core.php

@@ -5406,15 +5406,10 @@ function ur_process_login( $nonce_value ) {
 
 				if ( ur_is_ajax_login_enabled() && empty( $_POST['resubmitted'] ) ) { // phpcs:ignore
 					wp_send_json_success( array( 'message' => $redirect ) );
-					wp_send_json( $user );
 				} else {
 					wp_safe_redirect( $redirect );
 					exit;
 				}
-
-				if ( ur_is_ajax_login_enabled() && empty( $_POST['resubmitted'] ) ) { // phpcs:ignore
-					wp_send_json( $user );
-				}
 			}
 		} catch ( Exception $e ) {
 			$status_code = $e->getCode();

modules/membership/includes/Admin.php

@@ -995,12 +995,20 @@ public function protect_membership_post_meta() {
 		/**
 		 * Whether the current user may write membership post meta.
 		 *
+		 * Registered as a register_post_meta() auth_callback, which WordPress invokes with the
+		 * filter arguments below. AND-ing with $allowed means this can only ever narrow a core
+		 * decision, never widen one.
+		 *
 		 * @since 5.2.8
 		 *
+		 * @param bool   $allowed   Whether the write is allowed so far.
+		 * @param string $meta_key  Meta key being written.
+		 * @param int    $object_id Post ID.
+		 * @param int    $user_id   User attempting the write.
 		 * @return bool True when the user can manage the site's options.
 		 */
-		public function can_manage_membership_meta() {
-			return current_user_can( 'manage_options' );
+		public function can_manage_membership_meta( $allowed = false, $meta_key = '', $object_id = 0, $user_id = 0 ) {
+			return $allowed && current_user_can( 'manage_options' );
 		}
 
 		/**