![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Changes between Initial Version and Version 5 of Ticket #64316
- Timestamp:
- 11/28/2025 02:54:55 PM (8 months ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
Ticket #64316 – Description
initial v5 1 In wp-includes/pluggable.php, in the wp_new_user_notification function, on line 2285, the login URL is added to a message just after another URL which allows them to set their password.1 In `wp-includes/pluggable.php`, in the `wp_new_user_notification` function, on [https://github.com/WordPress/wordpress-develop/blob/6.8.3/src/wp-includes/pluggable.php#L2285 line 2285], the login URL is added to a message just after another URL which allows them to set their password. 2 2 3 LINE 2283 $message .= network_site_url( 'wp-login.php?login=' . rawurlencode( $user->user_login ) . "&key=$key&action=rp", 'login' ) . "\r\n\r\n";3 LINE 2283 `$message .= network_site_url( 'wp-login.php?login=' . rawurlencode( $user->user_login ) . "&key=$key&action=rp", 'login' ) . "\r\n\r\n";` 4 4 5 LINE 2285 $message .= wp_login_url() . "\r\n";5 LINE 2285 `$message .= wp_login_url() . "\r\n";` 6 6 7 7 8 8 This is confusing (since they can't log in yet anyway, not having set a password) and on some email clients (such as the popular ProtonMail), the carriage returns and new lines seem to be ignored altogether, meaning that this login URL is just tacked right on the end of the previous URL, like this... 9 9 10 Username: test To set your password, visit the following address: https://[domain]/wp-login.php?login=test&key=[KEY]&action=rp https://[domain]/wp-login.php 10 `Username: test To set your password, visit the following address: https://[domain]/wp-login.php?login=test&key=[KEY]&action=rp https://[domain]/wp-login.php` 11 11 12 12 Since for some reason the URL is not in a link the user can click, they will be copy-pasting the URL into their browser URL field. Most users will not notice that there are two separate URLs, so instead of being able to set a password, they will simply end up on an unusable login page. 13 13 14 Please get rid of the login URL at line 85, and, if possible, turn the other URL into a clickable link.14 Please get rid of the login URL at line 2285, and, if possible, turn the other URL into a clickable link.
