Make WordPress Core

Opened 7 years ago

Closed 7 years ago

Last modified 5 years ago

#39551 closed defect (bug) (duplicate)

Angle Brackets on password reset email unnecessary and conflicting with some setups

Reported by: bmiller6686's profile bmiller6686 Owned by:
Milestone: Priority: normal
Severity: normal Version:
Component: Login and Registration Keywords:
Focuses: Cc:


There is an inconsistency in how links are formatted when sent from system emails. For a new user being invited it is sent as

Hi, You've been invited to join 'Blog Name' at blog_url with the role of role. If you do not want to join this site please ignore this email. This invitation will expire in a few days. Please click the following link to activate your user account:

Whereas on a password reset email, angle brackets surround the link with keys. I can't see a reason for this and the angle brackets can actually cause the link to be removed in some cases. Case in point right now on my setup, if I die just the $message portion in wp-login.php for a password reset, the link isn't present. If however I remove the angle brackets and die($message) in the same place, the link is present.

The link not being present at all could be completely unique to my setup, but the lack of consistency between admin emails should probably be fixed, and the angle brackets seem unnecessary.

This exists on line 332 of wp-login.php. The revised snippet is as follows.


        $message .= '<' . network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . ">\r\n";


        $message .= network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . "\r\n";

Change History (2)

#1 @pento
7 years ago

  • Milestone Awaiting Review deleted
  • Resolution set to duplicate
  • Status changed from new to closed
  • Version 4.6 deleted

Thank you for the ticket, @bmiller6686!

This is currently being tracked in #23578, though it's worth noting that the bug is with your email client - wrapping URLs in angle brackets is recommended behaviour by both the w3c and in Section C of the URI RFC.

#2 @jhob
6 years ago

This is an issue if the email gets sent out as HTML content type - the link then gets parsed as HTML and is effectively rendered invisible.

I agree that, whilst they are w3c recommendations that they should be removed to increase compatibility with mail clients.

Seems to cause more trouble than the benefits are worth IMO.

Last edited 6 years ago by jhob (previous) (diff)
Note: See TracTickets for help on using tickets.