Password reset not working when username has spaces

  • Resolved sunofjuche

    (@sunofjuche)


    9 months, 3 weeks ago

    I noticed that password reset links are invalid for users whose username contains one or more whitespaces. As far as I can tell, the link, which contains “&login=%username%” part at its end, simply drops whatever comes after the first whitespace. Here you can see what the original link (contained in the email) looks like: username is just “Test” while the actual one is “Test user”

    And here’s what happens when I append the missing word to the link:

    Voila, it works this way. So, this should be some sort of a bug, I presume? I’m just surprised that I couldn’t find anything related to this issue, how come noone else has faced it so far?

Viewing 6 replies - 1 through 6 (of 6 total)

  • @sunofjuche

    I can’t reproduce your issue with username and a space.
    Which browser and email client are you using?

    Thread Starter sunofjuche

    (@sunofjuche)

    @missveronicatv
    Google Chrome.
    Email client is Gmail. But the issue persists with other clients too.
    Actually, I found out what is the cause. I’m using an SMTP service, and it changes links midway when sending messages, i.e. somehow wraps it, perhaps for security reasons. But I looked up what these messages looked like right before being sent, and links there are fine. The problem is that whitespaces aren’t properly url-encoded (should look like %20), which causes the service to think it’s the end of link.

    Now I have to think how this can be resolved best. Yes, it’s not related to the plugin, but if you have any clues, I’d highly appreciate.

    • This reply was modified 9 months, 3 weeks ago by sunofjuche.

    @sunofjuche

    You can try to urlencode the username in

    .../plugins/ultimate-member/includes/core/class-password.php line 55

    'login' => urlencode( $user_data->user_login ),

    Thread Starter sunofjuche

    (@sunofjuche)

    @missveronicatv
    Thanks for the suggestion, it works properly now. However, editing plugin’s core code is not the best idea. Do you think plugin devs could consider adding this feature (url encoding username) natively, or at least adding a hook to this function so that users can do the necessery processing themselves?

    @sunofjuche

    I have made an UM bug report about this issue:

    https://github.com/ultimatemember/ultimatemember/issues/1460

    Thread Starter sunofjuche

    (@sunofjuche)

    @missveronicatv

    Great, appreciate your help! Resolved

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘Password reset not working when username has spaces’ is closed to new replies.