Changeset 11804 breaks password reminder

[Denis-de-Bernardy]

Shouldn't it also try the email?

[westi]

Why do we need to check the email.

This code is processing the link that the user clicks on or copies from the email they are sent by the password reset request form.

The data is never user entered and the email contains the username even when they specify an email address.

[azaozz]

Exactly, the user_login is included in the custom URL in the password reset email (line 164). Where would the user_email come from so it limits the query on line 196?

[Denis-de-Bernardy]

Replying to westi:

Why do we need to check the email.

Because, if you use the form, it says enter your username or email. That would be why.

[Denis-de-Bernardy]

You would know that if you had paid attention when you tried the patch. ;-)

[Denis-de-Bernardy]

but then ok, it's still working. my bad. I must confess I hadn't tested at all. :-P