getgrav / getgrav/grav-plugin-admin

Unable to reset a password by a user with a space in their username

Open
#2,417 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
377
Forks
225
Avg merge
11h 51m
Merged PRs (30d)
4

Description

# Description

When a user has a space in their username, they are unable to reset a forgotten password.

It looks like some URL (un)escaping issue.

# Version

* Grav v1.7.46
* Admin v1.10.46

# Steps to reproduce

* Go to `https://HOSTNAME/admin/accounts/users/:add` to add a new user and fill the form:
* Username: `test T`
* Email: (your email address)
* Full name: `Testor Testorson` (or anything else)
* Go to `https://HOSTNAME/admin/forgot` to reset a password
* Username: `test T`
* Check your email and go to the reset URL
* For example: `https://HOSTNAME/admin/reset/u/test T/fd16523e91eab7acc748ed01715b1d4c`
* Username is now pre-filled with `test%20t` (the username is URL-encoded with the space replaced with `%20`)
* When you fill a new password and press the button, the `RESET_INVALID_LINK` error message is shown

Contributor guide

Open the contributing guide

Research direction

Reproduce the password-reset flow in Grav Admin using the username `test T`, starting at `/admin/forgot` and following the generated reset URL. Trace how the username is encoded and decoded between the email link and reset submission; done means the password can be reset successfully for a username containing a space.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.