653406 - Users with a + in their email address are unable to reset their passwords

Status: RESOLVED FIXED

(Bugzilla :: User Accounts, defect)

Description

[Dave Miller [:justdave]]

Attachment: screenshot of error message

Going by the attached error screenshot it looks like a + in an email address is getting unescaped somehow when it shouldn't be (and thus getting treated as a space).

Comment 1

[:glob ✱]

i'm able to create new accounts with a + in the email address, and login as an existing account which contains a +.

do you have steps to reproduce?

Comment 2

[Frédéric Buclin]

WFM upstream. Maybe the guy typed his email address in the URL bar directly, in which case an unescaped + means a whitespace.

Comment 3

[:glob ✱]

i've tested all points where we throw that error and it's working for me too.

nukeador, please reopen this bug if you are still having problems.

Comment 4

[Rubén Martín [:Nukeador] ❌ [away till Aug 31st]]

I have my bugzilla session opened at home and I will be able to answer you guys till it expires, but I'm unable to log in using a clean session, same error. Tested from 2 computer and 2 different browsers.

I think the problem is that first I get an error about my password it's less than 8 characters long and then it points me to request a new password:

https://bugzilla.mozilla.org/token.cgi?a=reqpw&loginname=[e-mail]

Where I get the error and I can't continue or log in.

Comment 5

[:glob ✱]

thanks rubén, that helps a lot :)

Comment 6

[:glob ✱]

Attachment: patch for 4.0, v1

fixes quoting of text in error messages.

Comment 7

[Frédéric Buclin]

Comment on attachment 528892 [details] [diff] [review]
patch for 4.0, v1

You need a separate patch for 4.1, as FILTER url_quote has been killed in favor of FILTER uri (see bug 398701). r=LpSolit for 4.0.2.

Comment 8

[:glob ✱]

Attachment: patch for 4.1, v1

Comment 9

[:glob ✱]

Comment on attachment 528909 [details] [diff] [review]
patch for 4.1, v1

oops

Comment 10

[:glob ✱]

Attachment: patch for 4.1, v2

<LpSolit> r+ with the first block removed

Comment 11

[Frédéric Buclin]

The patch for 4.0 applies cleanly to 3.6.5, so let's take it on this branch too. I know the 3.6 branch is restricted to security bugs, but not being able to log in is a major issue, and we cannot leave users out of the game. Bugzilla 3.4 is not affected.

Comment 12

[Dave Miller [:justdave]]

(In reply to comment #11)

Agreed

Comment 13

[:glob ✱]

Committing to: bzr+ssh://[e-mail]/bugzilla/3.6/
modified template/en/default/global/user-error.html.tmpl
Committed revision 7248.

Committing to: bzr+ssh://[e-mail]/bugzilla/4.0/
modified template/en/default/global/user-error.html.tmpl
Committed revision 7590.

Committing to: bzr+ssh://bzr.mozilla.org/bugzilla/trunk/
modified template/en/default/global/user-error.html.tmpl
Committed revision 7805.