Follow-up: Password reset link appears to be invalid – Unless copied and pasted

Hi.

We have tested this but we were unable to replicate this issue.

We have some questions if you would like to help us debug this.

1. Are you using any custom reset password emails or a plugin that allows you to customize them?

2. What client are you using to view the email?

3. Are you able to look at the source of the email that you have received? Does the link contain HTML entities in the source of the email?

Thanks,
SendGrid

Thanks for the quick reply, see answers below:

1. Are you using any custom reset password emails or a plugin that allows you to customize them?

Yes, we use a custom plugin to transform the default WordPress e-mails in to HTML e-mails. This plugin basically adds just a neat HTML email header and footer to the default WordPress emails.

What client are you using to view the email?

https://mail.google.com/

Are you able to look at the source of the email that you have received? Does the link contain HTML entities in the source of the email?

Yes, i can view the original source of the mail:

<p>To reset your password, visit the following address: <a href=3D"https://=
u2048426.ct.sendgrid.net/wf/click?upn=*************************************=
***************************************************************************=
***************************************************************************=
***************************************************************************=
***************************************************************************=
***************************************************************************=
***********************" rel=3D"nofollow">https://www.************.nl/wp-log=
in.php?action=3Drp&key=**********************&login=3Dpronamic</a=
></p>

Please note that www.ads-software.com is converting the entities, so check the Gist for the exact characters:

https://gist.github.com/remcotolsma/66aabbc6181b58c9d4d612bf6cc8533f#link-in-original-e-mail-source-with-sendgrid-plugin

Also note that the link is working correctly if we disable the SendGrid plugin:

<p>To reset your password, visit the following address: <a href="https://www.************.nl/wp-login.php?action=rp&key=**********************&login=pronamic" rel="nofollow">https://www.************..nl/wp-login.php?action=rp&key=**********************&login=pronamic</a></p>

https://gist.github.com/remcotolsma/66aabbc6181b58c9d4d612bf6cc8533f#link-in-original-e-mail-source-without-sendgrid-plugin

It looks like you retrieve the href attribute and just use that exact value to create a track link. You only forget that a href attribute can contain HTML entities which you need to convert to the corresponding charachters for a correct HTTP redirect (Location: ...).

Hello,

We finally succeeded to reproduce your issue. We will investigate further in order to fix it and we’ll let you know once we have a solution.

Thank you,
SendGrid

Good to hear you can reproduce this issue, do you know when we can exepect a solution?

@sendgrid how is this going, can we expect a fix anytime soon?

Any update on this?

Ping.

Hi.

We’ve looked into this and unfortunately we cannot change the way that redirect works for Click Tracking. We risk breaking a lot more URLs than fixing them.

The only solution would be to either disable Click Tracking from your SendGrid account dashboard or to disable click tracking per link basis as you can see here:

https://sendgrid.com/docs/Classroom/Track/Clicks/click_tracking_html_best_practices.html

This would require that you explicitly disable Click Tracking for links which you know that contain the ampersand symbol &.

As for the default WordPress email templates, they can be edited programmatically or using one of the various plugin solutions.

We will close this topic since there is nothing more we can do.

We’ve looked into this and unfortunately we cannot change the way that redirect works for Click Tracking. We risk breaking a lot more URLs than fixing them.

I don’t think you need to change the way redirect works for Click Tracking. You have to change the way you parse the HTML anchor elements. If you find links in a ‘href’ attribute you have to make sure to convert ‘#038;’ chars to just ‘&’.