95536 - Password reset issues tokens w/ "&" in them, URL not escaped

Status: VERIFIED DUPLICATE of bug 95535

(Bugzilla :: Bugzilla-General, defect)

Description

[Dave Miller [:justdave]]

I requested a password reset on one of the landfill installs and got this: 
(you'll have to ignore the fact that someone forgot to set the baseurl in
editparams)

Notice that the token on the end of the URL contains a & in the token, and it
didn't get escaped in the URL.

Date: Wed, 15 Aug 2001 18:26:16 -0700
From: [e-mail]
To: [e-mail]
Subject: Bugzilla Change Password Request

You or someone impersonating you has requested to change your Bugzilla
password.  To change your password, visit the following link:

http://cvs-mirror.mozilla.org/webtools/bugzilla/token.cgi?a=cfmpw&t=V&l*Cv0w

If you are not the person who made this request, or you wish to cancel
this request, visit the following link:

http://cvs-mirror.mozilla.org/webtools/bugzilla/token.cgi?a=cxlpw&t=V&l*Cv0w

Comment 1

[Dave Miller [:justdave]]

grrrr (double-submitted)

*** This bug has been marked as a duplicate of 95535 ***

Comment 2

[Jacob Steenhagen]

V. double-submit.

Comment 3

[Dave Miller [:justdave]]

moving all closed Bugzilla bugs to the new Bugzilla product.
This batch is DUPLICATE/INVALID/WORKSFORME/WONTFIX
reassigning to default owner and QA in case of the bug being reopened.
Clearing milestones, since we really shouldn't have them on these types of
resolutions.  Sorry for the spam everyone...

Comment 4

[Markus Gerstel]

Verification got lost