2

I am sending the set Password URL to a user to set their password after ADMIN create a user in CP.

I am using craft()->users->getPasswordResetUrl($user) to generate the URL for set password which is look like https://<my domain>/actions/users/setpassword?code=8MHKqfmt6Te%5C_dyuCouL4PMaT%7EE%7EV9jNO&id=8bf376ca-e260-44b9-9ad2-0cc623fe4c4c However, I got intermittent user report they get "Oops! Invalid verification code. Please login or reset your password." message pop up after click the link.

In general.php, I have 'verificationCodeDuration' => 'P7D' to make sure the code could last for 7 days.

Does anyone has idea how to verify the code in DB? Looks the verficationCode column in DB is encrypted. Does anyone know how to solve that issue? Thanks

Improve this question

1 Answer 1

Reset to default
1

If it's just some users, I've seen some email clients split the link with a newline and when users click it, they don't get the full token in the URL producing an invalid one when Craft tries to verify it.

In those cases, it's recommended that the user manually copy and paste the full URL instead of clicking on it.

Improve this answer
6
  • I copied the full token link and paste to the web browser, but I get the same error message. I found that it happens most of the time when "Enter your password to continue." message pop up, or system response time is a little bit longer. Does the verification code generated related to time or some session parameters?
    – Angela Chan
    Jul 27, 2017 at 18:34
  • I found that this issue is on _setVerificationCodeOnUserRecord(UserRecord $userRecord) function return the $unhashedCode in usersServices.php. If $unhashedCode has underscore "_", It gets translate to "%5C_" (which is \_ ) in the email which makes the code in URL not match with the one in DB. Since I cannot control the translate in the email system, I would like to replace "_" with another character. What is the best way to do it without touching the core code? Thanks
    – Angela Chan
    Jul 27, 2017 at 19:47
  • It's only underscores that are getting encoded? Nothing else? If so, what are your php.ini file's arg_separator.input and arg_separator.output values set to?
    – Brad Bell ♦
    Jul 27, 2017 at 20:12
  • Yes, just underscore "_" (so far I don't see any other special character add backslash ) Nothing is set in php.ini on arg_separator.input and arg_separator.output.
    – Angela Chan
    Jul 27, 2017 at 21:00
  • Running out of ideas... maybe it's the email client doing the encoding for some weird reason?
    – Brad Bell ♦
    Jul 27, 2017 at 22:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.