ERROR:Invalid key! with Recover Password shortcode

  • Resolved traumm

    (@traumm)


    5 years, 10 months ago

    Hi there

    Using the [wppb-recover-password] shortcode

    I’m getting an error if the username has special characters, e.g. is an email address.

    The URL sent to the user is along the lines of:

    https://mywebsite.co.uk/reset-password/?submitted=yes&loginName=memywebsite-co-uk&key=Fo15KnnndeZ0JdCSoY4l

    The loginName parameter is stripping out the @ and swapping the full stops for hyphens, so I’m getting an ‘Error! Invalid Key’ message when visiting the page.

    loginName=memywebsite-co-uk

    If I change this manually in the URL to:

    [email protected]

    …the reset form appears without an error.

    If the username has no special characters or full stops, it works correctly.

    Again, your help’s appreciated!

    • This topic was modified 5 years, 10 months ago by traumm.
    • This topic was modified 5 years, 10 months ago by traumm.
Viewing 15 replies - 1 through 15 (of 22 total)

  • Hello there,

    This is a known issue that was supposed to be fixed in the last update.

    What version are you using?

    With the best of regards,
    Gabriel

    I’m having the same issue. Running 2.9.5.

    • This reply was modified 5 years, 10 months ago by lpcampfire.

    Hello dears,

    We are not able to reproduce the issue.

    It appears to require further investigation.

    Please open a support ticket here.

    https://www.cozmoslabs.com/support/open-ticket/

    Thanks,
    Gabriel

    Sorry i haven’t seen this post and made a new tread on this bug.

    So if you want to reproduce the bug do this:

    Create a user with space inside (wordpress allow you to do that): ex. “User Name”
    then try to make password lost request
    you receive the email with a link to change it and in this link the space is converted with “-” so the result once you click on it is “The key is not valid”

    i tried to change “-” with “%20” in the url and worked fine.

    Please fix soon

    Thank you
    Regards
    Riccardo

    • This reply was modified 5 years, 10 months ago by ricctram.

    All right, thanks, I have managed to reproduce it and I am forwarding it to the development team.

    Cheers!

    Thread Starter traumm

    (@traumm)

    Thanks Gabriel. Just to confirm, I’m running the latest version: 2.9.5

    All the best!

    Yes, yes. I have tested it on the latest version, and indeed the bug is present. Thanks!

    @gabrielberzescu

    I’ve plugin to latest version but still it is Password reset link not working. Showing invalid key error.

    Hi Umesh,

    Are you also getting this problem with usernames that have the space character, or some other special characters?

    Or all usernames, even the one containing just lowercase letters?

    We thought we fixed this some time ago. I can no longer reproduce. It works well now on my test rig (even with spaces).

    With the best of regards,
    Gabriel

    @gabrielberzescu

    Yes, The reset link is working for username umeshnevase2 but not working for umesh.nevase2

    OK, I see so it’s a problem when you have the full stop.

    I have attempted to reproduce it with no success so far.

    On my test rig, password recovery works well even for usernames that contain a full stop.

    Can you please paste here the password recovery URL that you are getting in the email?

    For instance, I get something like

    https://site.ro/wppb-recover-password/?submitted=yes&loginName=cu.punct&key=bdG9T7QAUcmMSEFrTupd

    and it works.

    Best regards,

    Hi @gabrielberzescu

    I’ve shared URL here https://onetimesecret.com/secret/npqdzvm09txbm3lvqoqljjm4i4wtgvv
    It will expire in one day.

    @gabrielberzescu

    Did you get the time to check further. I noticed one thing that the username is a password reset link getting changed. umesh.nevase2 is changed to umesh-nevase2, If I manutally replace the ‘-‘ character to ‘.’ again, the reset link is working and I can reset the password.

    Hi there,

    Sorry for the long delay, I was away from the office, and apparently there was great load on the support team, so nobody could take this over.

    OK, so you are getting the “-” character in the email?

    This is rather peculiar, since I can not reproduce, I am getting the “.” character in the email.

    This leads me to strongly suspect that another plugin / theme functionality is interfering, so please perform the following conflict text.

    *Briefly* disable all other plugins and enable the default Twenty Nineteen theme. If this fixes the problem, as it probably will, enable everything one by one, checking each time to see when the problem returns.

    Please let us know when you find the conflict so that we can take a look and see what we can do about it.

    With the best of regards,
    Gabriel

    Hi, I’m also experiencing this problem. I then tried installing your plugin on a clean website with no other plugins and still the problem persists (@gabrielberzescu this is something you could have also done on your end without asking us to try). When using an email address the @ sign is removed from the recovery url and the dots (.) are replaced with dashes (-). If I replace the characters with what supposed to be in there then the plugin allows me to see the Password and Repeat Password fields.

Viewing 15 replies - 1 through 15 (of 22 total)
  • The topic ‘ERROR:Invalid key! with Recover Password shortcode’ is closed to new replies.