thm-projects / arsnova-customization

0 stars 1 forks source link

password in resetPassword() not URL encoded #3

Closed Rillke closed 5 years ago

Rillke commented 8 years ago

First I'd like to apologize for reporting here as it is a customization issue; it seems to be impossible for me to get an account at https://git.thm.de

In https://git.thm.de/arsnova/arsnova-customization/blob/master/src/main/webapp/account.html#L280 it seems you send the new password not url encoded. Users may type %20 or similar in their passwords and do not expect they have to fill a white space at next login time. To mitigate this issue, I suggest e.g. copying jQuery.post. It takes care of this and a lot more, e.g. the issue reported in thm-projects/arsnova-backend#36

Rillke commented 8 years ago

On arsnova.eu, there is additionally (b.) the issue that the reset button is greyed out and (c.) you are redirected to https://arsnova.thm.de/blog/ after logging in.

Steps to reproduce on arsnova.eu: