Unnecessary and confusing addition of (unusable) login URL on end of new user notification

[clayray]

In wp-includes/pluggable.php, in the wp_new_user_notification function, on ​line 2285, the login URL is added to a message just after another URL which allows them to set their password.

LINE 2283 $message .= network_site_url( 'wp-login.php?login=' . rawurlencode( $user->user_login ) . "&key=$key&action=rp", 'login' ) . "\r\n\r\n";

LINE 2285 $message .= wp_login_url() . "\r\n";

This is confusing (since they can't log in yet anyway, not having set a password) and on some email clients (such as the popular ProtonMail), the carriage returns and new lines seem to be ignored altogether, meaning that this login URL is just tacked right on the end of the previous URL, like this...

Username: test To set your password, visit the following address: https://[domain]/wp-login.php?login=test&key=[KEY]&action=rp https://[domain]/wp-login.php

Since for some reason the URL is not in a link the user can click, they will be copy-pasting the URL into their browser URL field. Most users will not notice that there are two separate URLs, so instead of being able to set a password, they will simply end up on an unusable login page.

Please get rid of the login URL at line 2285, and, if possible, turn the other URL into a clickable link.

[clayray]

Sorry, forget about adding a clickable link. Didn't realise this was a security no-no.

And thanks for your help!

C

[johnbillion]

I agree that removing the login URL at the bottom of this email makes sense. A new user cannot do anything actionable on the regular login screen if they are yet to set a password.

Regarding formatting and clickable links, it sounds like either your site is configured to send emails as HTML, or your email client is incorrectly treating it as an HTML email, which causes the line breaks to collapse. All emails sent by WordPress are plain text emails with plain links.

This PR updates the wp_new_user_notification() function to remove the unnecessary login URL that appears at the end of the new user notification email.

This URL is confusing and unusable because the user cannot log in before setting a password.
On some email clients, line breaks are collapsed, causing the login URL to appear merged with the reset-password link.

Removing the login URL prevents users from being directed to an unusable login screen.

[manhphucofficial]

Attached a GitHub pull request for this change:
​https://github.com/WordPress/wordpress-develop/pull/10566

[pratiklondhe]

Patch for removing login url from the new user email

[SergeyBiryukov]

In 61321:

Login and Registration: Remove redundant login URL at the end of new user notification.

This became unnecessary (and confusing) after the plaintext password was removed from the email, and the URL to set a new password was added directly above in WordPress 4.3.

Follow-up to [2872], [8058], [10931], [33023].

Props clayray, manhphucofficial, pratiklondhe, johnbillion, SergeyBiryukov.
Fixes #64316.