Ticket #14140: t14140-url-angle-brackets.diff

wp-login.php

@@ -190 +190 @@
         $message .= network_site_url() . "\r\n\r\n";
         $message .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n";
         $message .= __('To reset your password visit the following address, otherwise just ignore this email and nothing will happen.') . "\r\n\r\n";
-        $message .= network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . "\r\n";
+        $message .= '<' . network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . '>' . "\r\n";
 
         if ( is_multisite() )
                 $blogname = $GLOBALS['current_site']->site_name;