Make WordPress Core

#39551 closed defect (bug) (duplicate)

Angle Brackets on password reset email unnecessary and conflicting with some setups

Reported by: bmiller6686 Owned by:
Milestone: Priority: normal
Severity: normal Version:
Component: Login and Registration Keywords:
Focuses: Cc:


There is an inconsistency in how links are formatted when sent from system emails. For a new user being invited it is sent as

Hi, You've been invited to join 'Blog Name' at blog_url with the role of role. If you do not want to join this site please ignore this email. This invitation will expire in a few days. Please click the following link to activate your user account: http://example.com/wp-activate.php?key=2f8ffcf9a8da6004

Whereas on a password reset email, angle brackets surround the link with keys. I can't see a reason for this and the angle brackets can actually cause the link to be removed in some cases. Case in point right now on my setup, if I die just the $message portion in wp-login.php for a password reset, the link isn't present. If however I remove the angle brackets and die($message) in the same place, the link is present.

The link not being present at all could be completely unique to my setup, but the lack of consistency between admin emails should probably be fixed, and the angle brackets seem unnecessary.

This exists on line 332 of wp-login.php. The revised snippet is as follows.


        $message .= '<' . network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . ">\r\n";


        $message .= network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . "\r\n";

Change History (1)

#1 @pento
17 months ago

  • Milestone Awaiting Review deleted
  • Resolution set to duplicate
  • Status changed from new to closed
  • Version 4.6 deleted

Thank you for the ticket, @bmiller6686!

This is currently being tracked in #23578, though it's worth noting that the bug is with your email client - wrapping URLs in angle brackets is recommended behaviour by both the w3c and in Section C of the URI RFC.

Note: See TracTickets for help on using tickets.