search

ether / pad

Etherpad Open-Source Repository
http://github.com/ether/pad
Other
1.03k stars 184 forks source link

Etherpad does not URL encode temporary passwords when sending out invite email #316

Closed gerv closed 10 years ago

gerv commented 12 years ago

I recently got this email:

Dear gerv,

has created an account for you on . You can sign in by clicking on the following link: https:///ep/account/sign-in?uid=1822&tp=3+ninE=12 Note the "+" sign in the temporary password (tp). These should be URL encoded. Otherwise, my web browser interprets the "+" as a space, and the password gets mangled, and I get an error: "That password reset link that is no longer valid. (Bad temp pass.)" Hand URL-encoding the "+" (and the "=") made it work. So you need to call a URL encoder on the tp value before writing it out in the URL in the email. I don't know how to tell which version of Etherpad this is; if you tell me how to find out, I will. Gerv