Changeset 58674

Timestamp:

07/04/2024 09:59:34 PM (5 weeks ago)

Author:

dmsnell

Message:

Users: Avoid ambiguous password reset URLs for usernames ending in a period.

When WordPress sends out a password-reset or new-user email, it generates
a link for someone to follow in order to take them to the reset page. If
the user login name ends in a period, however, that generated URL will
end in a period and many email clients will confuse it with a
sentence-ending period instead of being part of the query arguments.

In this patch, the generated URL's query argument are rearranged so that
the link will never end in a period. Alternative ideas were explored to
create a new function to escape URL-ending periods, but this patch resolves
the reported problem without raising any further architectural questions.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/6834
Discussed in https://core.trac.wordpress.org/ticket/42957

Props audrasjb, costdev, daveagp, dmsnell, hellofromTonya, markparnell, mukesh27, nhrrob, obrienlabs, paulcline.
Fixes #42957.

Location:

trunk/src/wp-includes

Files:

• pluggable.php (modified) (1 diff)
• user.php (modified) (1 diff)

trunk/src/wp-includes/pluggable.php

@@ -2225 +2225 @@
         $message  = sprintf( __( 'Username: %s' ), $user->user_login ) . "\r\n\r\n";
         $message .= __( 'To set your password, visit the following address:' ) . "\r\n\r\n";
-        $message .= network_site_url( "wp-login.php?action=rp&key=$key&login=" . rawurlencode( $user->user_login ), 'login' ) . "\r\n\r\n";
+
+        /*
+         * Since some user login names end in a period, this could produce ambiguous URLs that
+         * end in a period. To avoid the ambiguity, ensure that the login is not the last query
+         * arg in the URL. If moving it to the end, a trailing period will need to be escaped.
+         *
+         * @see https://core.trac.wordpress.org/tickets/42957
+         */
+        $message .= network_site_url( 'wp-login.php?login=' . rawurlencode( $user->user_login ) . "&key=$key&action=rp", 'login' ) . "\r\n\r\n";
 
         $message .= wp_login_url() . "\r\n";

trunk/src/wp-includes/user.php

@@ -3220 +3220 @@
     $message .= __( 'If this was a mistake, ignore this email and nothing will happen.' ) . "\r\n\r\n";
     $message .= __( 'To reset your password, visit the following address:' ) . "\r\n\r\n";
-    $message .= network_site_url( "wp-login.php?action=rp&key=$key&login=" . rawurlencode( $user_login ), 'login' ) . '&wp_lang=' . $locale . "\r\n\r\n";
+
+    /*
+     * Since some user login names end in a period, this could produce ambiguous URLs that
+     * end in a period. To avoid the ambiguity, ensure that the login is not the last query
+     * arg in the URL. If moving it to the end, a trailing period will need to be escaped.
+     *
+     * @see https://core.trac.wordpress.org/tickets/42957
+     */
+    $message .= network_site_url( 'wp-login.php?login=' . rawurlencode( $user_login ) . "&key=$key&action=rp", 'login' ) . '&wp_lang=' . $locale . "\r\n\r\n";
 
     if ( ! is_user_logged_in() ) {