diff --git a/core/modules/user/user.module b/core/modules/user/user.module
index f80375f..f645e41 100644
--- a/core/modules/user/user.module
+++ b/core/modules/user/user.module
@@ -806,14 +806,6 @@ function user_block_view($delta = '') {
     case 'login':
       // For usability's sake, avoid showing two login forms on one page.
       if (!$user->uid && !(arg(0) == 'user' && !is_numeric(arg(1)))) {
-        // Customize the login form.
-        $form = drupal_get_form('user_login_form');
-        unset($form['name']['#attributes']['autofocus']);
-        unset($form['name']['#description']);
-        unset($form['pass']['#description']);
-        $form['name']['#size'] = 15;
-        $form['pass']['#size'] = 15;
-        $form['#action'] = url(current_path(), array('query' => drupal_get_destination(), 'external' => FALSE));
         // Build action links.
         $items = array();
         if (config('user.settings')->get('register') != USER_REGISTER_ADMINISTRATORS_ONLY) {
@@ -830,6 +822,14 @@ function user_block_view($delta = '') {
             'class' => array('request-password-link'),
           ),
         ));
+        // Build the user_login_block_form(), using user_login_form() as base
+        // form ID, so drupal_alter(), #validate, #submit, and #theme for
+        // user_login_form() are taken into account.
+        $form_state = array();
+        $form_state['build_info']['args'] = array();
+        $form_state['build_info']['base_form_id'] = 'user_login_form';
+        $form = drupal_build_form('user_login_block_form', $form_state);
+
         // Build a block as renderable array.
         $block['subject'] = t('User login');
         $block['content'] = array(
@@ -1603,6 +1603,28 @@ function user_login_form($form, &$form_state) {
 }
 
 /**
+ * Form constructor for the user login form in the user login block.
+ *
+ * @see user_block_view()
+ */
+function user_login_block_form($form, &$form_state) {
+  $form = user_login_form($form, $form_state);
+  // Submit the form to the current path.
+  $form['#action'] = url(current_path(), array('query' => drupal_get_destination(), 'external' => FALSE));
+  // Prevent autofocus from stealing focus.
+  unset($form['name']['#attributes']['autofocus']);
+  // Remove descriptions; they are too long for the block.
+  unset($form['name']['#description']);
+  unset($form['pass']['#description']);
+  // Make login form elements smaller.
+  // @todo Move into CSS.
+  $form['name']['#size'] = 15;
+  $form['pass']['#size'] = 15;
+
+  return $form;
+}
+
+/**
  * Set up a series for validators which check for blocked users,
  * then authenticate against local database, then return an error if
  * authentication fails. Distributed authentication modules are welcome