ERROR:Invalid key! with Recover Password shortcode

Resolved traumm
(@traumm)

6 years, 11 months ago
Hi there

Using the [wppb-recover-password] shortcode

I’m getting an error if the username has special characters, e.g. is an email address.

The URL sent to the user is along the lines of:

http://mywebsite.co.uk/reset-password/?submitted=yes&loginName=memywebsite-co-uk&key=Fo15KnnndeZ0JdCSoY4l

The loginName parameter is stripping out the @ and swapping the full stops for hyphens, so I’m getting an ‘Error! Invalid Key’ message when visiting the page.

loginName=memywebsite-co-uk

If I change this manually in the URL to:

loginName=me@mywebsite.co.uk

…the reset form appears without an error.

If the username has no special characters or full stops, it works correctly.

Again, your help’s appreciated!
- This topic was modified 6 years, 11 months ago by traumm.
- This topic was modified 6 years, 11 months ago by traumm.

Viewing 15 replies - 1 through 15 (of 22 total)

1 2 →

Gabriel Berzescu
(@gabrielberzescu)

6 years, 11 months ago

Hello there,

This is a known issue that was supposed to be fixed in the last update.

What version are you using?

With the best of regards,
Gabriel
lpcampfire
(@lpcampfire)

6 years, 11 months ago
I’m having the same issue. Running 2.9.5.
- This reply was modified 6 years, 11 months ago by lpcampfire.
Gabriel Berzescu
(@gabrielberzescu)

6 years, 11 months ago

Hello dears,

We are not able to reproduce the issue.

It appears to require further investigation.

Please open a support ticket here.

https://www.cozmoslabs.com/support/open-ticket/

Thanks,
Gabriel
ricctram
(@ricctram)

6 years, 11 months ago
Sorry i haven’t seen this post and made a new tread on this bug.

So if you want to reproduce the bug do this:

Create a user with space inside (wordpress allow you to do that): ex. “User Name”
then try to make password lost request
you receive the email with a link to change it and in this link the space is converted with “-” so the result once you click on it is “The key is not valid”

i tried to change “-” with “%20” in the url and worked fine.

Please fix soon

Thank you
Regards
Riccardo
- This reply was modified 6 years, 11 months ago by ricctram.
Gabriel Berzescu
(@gabrielberzescu)

6 years, 11 months ago

All right, thanks, I have managed to reproduce it and I am forwarding it to the development team.

Cheers!

Thread Starter traumm
(@traumm)

6 years, 11 months ago

Thanks Gabriel. Just to confirm, I’m running the latest version: 2.9.5

All the best!

Gabriel Berzescu
(@gabrielberzescu)

6 years, 11 months ago

Yes, yes. I have tested it on the latest version, and indeed the bug is present. Thanks!

Umesh Nevase
(@umeshnevase)

6 years, 7 months ago

@gabrielberzescu

I’ve plugin to latest version but still it is Password reset link not working. Showing invalid key error.
Gabriel Berzescu
(@gabrielberzescu)

6 years, 7 months ago
Hi Umesh,

Are you also getting this problem with usernames that have the space character, or some other special characters?

Or all usernames, even the one containing just lowercase letters?

We thought we fixed this some time ago. I can no longer reproduce. It works well now on my test rig (even with spaces).

With the best of regards,
Gabriel
- This reply was modified 6 years, 7 months ago by Gabriel Berzescu.
Umesh Nevase
(@umeshnevase)

6 years, 7 months ago

@gabrielberzescu

Yes, The reset link is working for username umeshnevase2 but not working for umesh.nevase2
Gabriel Berzescu
(@gabrielberzescu)

6 years, 7 months ago
OK, I see so it’s a problem when you have the full stop.

I have attempted to reproduce it with no success so far.

On my test rig, password recovery works well even for usernames that contain a full stop.

Can you please paste here the password recovery URL that you are getting in the email?

For instance, I get something like

https://site.ro/wppb-recover-password/?submitted=yes&loginName=cu.punct&key=bdG9T7QAUcmMSEFrTupd

and it works.

Best regards,
- This reply was modified 6 years, 7 months ago by Gabriel Berzescu.
Umesh Nevase
(@umeshnevase)

6 years, 7 months ago

Hi @gabrielberzescu

I’ve shared URL here https://onetimesecret.com/secret/npqdzvm09txbm3lvqoqljjm4i4wtgvv
It will expire in one day.

Umesh Nevase
(@umeshnevase)

6 years, 7 months ago

@gabrielberzescu

Did you get the time to check further. I noticed one thing that the username is a password reset link getting changed. umesh.nevase2 is changed to umesh-nevase2, If I manutally replace the ‘-‘ character to ‘.’ again, the reset link is working and I can reset the password.

Gabriel Berzescu
(@gabrielberzescu)

6 years, 6 months ago

Hi there,

Sorry for the long delay, I was away from the office, and apparently there was great load on the support team, so nobody could take this over.

OK, so you are getting the “-” character in the email?

This is rather peculiar, since I can not reproduce, I am getting the “.” character in the email.

This leads me to strongly suspect that another plugin / theme functionality is interfering, so please perform the following conflict text.

*Briefly* disable all other plugins and enable the default Twenty Nineteen theme. If this fixes the problem, as it probably will, enable everything one by one, checking each time to see when the problem returns.

Please let us know when you find the conflict so that we can take a look and see what we can do about it.

With the best of regards,
Gabriel

Design2code
(@design2code)

6 years, 5 months ago

Hi, I’m also experiencing this problem. I then tried installing your plugin on a clean website with no other plugins and still the problem persists (@gabrielberzescu this is something you could have also done on your end without asking us to try). When using an email address the @ sign is removed from the recovery url and the dots (.) are replaced with dashes (-). If I replace the characters with what supposed to be in there then the plugin allows me to see the Password and Repeat Password fields.