grav-plugin-admin
grav-plugin-admin copied to clipboard
Unable to reset a password by a user with a space in their username
Description
When a user has a space in their username, they are unable to reset a forgotten password.
It looks like some URL (un)escaping issue.
Version
- Grav v1.7.46
- Admin v1.10.46
Steps to reproduce
- Go to
https://HOSTNAME/admin/accounts/users/:add
to add a new user and fill the form:- Username:
test T
- Email: (your email address)
- Full name:
Testor Testorson
(or anything else)
- Username:
- Go to
https://HOSTNAME/admin/forgot
to reset a password- Username:
test T
- Username:
- Check your email and go to the reset URL
- For example:
https://HOSTNAME/admin/reset/u/test T/fd16523e91eab7acc748ed01715b1d4c
- Username is now pre-filled with
test%20t
(the username is URL-encoded with the space replaced with%20
) - When you fill a new password and press the button, the
RESET_INVALID_LINK
error message is shown
- For example: