getgrav / getgrav/grav-plugin-admin
Unable to reset a password by a user with a space in their username
- Dominant language
- PHP
- Stars
- 377
- Forks
- 225
- Avg merge
- 11h 51m
- Merged PRs (30d)
- 4
Description
# Description
When a user has a space in their username, they are unable to reset a forgotten password.
It looks like some URL (un)escaping issue.
# Version
* Grav v1.7.46
* Admin v1.10.46
# Steps to reproduce
* Go to `https://HOSTNAME/admin/accounts/users/:add` to add a new user and fill the form:
* Username: `test T`
* Email: (your email address)
* Full name: `Testor Testorson` (or anything else)
* Go to `https://HOSTNAME/admin/forgot` to reset a password
* Username: `test T`
* Check your email and go to the reset URL
* For example: `https://HOSTNAME/admin/reset/u/test T/fd16523e91eab7acc748ed01715b1d4c`
* Username is now pre-filled with `test%20t` (the username is URL-encoded with the space replaced with `%20`)
* When you fill a new password and press the button, the `RESET_INVALID_LINK` error message is shown
Contributor guide
Research direction
Reproduce the password-reset flow in Grav Admin using the username `test T`, starting at `/admin/forgot` and following the generated reset URL. Trace how the username is encoded and decoded between the email link and reset submission; done means the password can be reset successfully for a username containing a space.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100