Activation link in e-mail account verification

👍 Gathering votes

The issue is related to email clients with a bug that misinterprets the Activation link {ARM_VALIDATE_URL} in e-mail account verification.

For example: https://www.mysite.com/login/?arm-key=GtSZR%25dA3M&email=email%40email.it => In the "arm-key," there is a URL-encoded value that breaks because when decoded, it contains the special character "%".

It seems that some email clients misinterpret the link and perform URL decoding when the link is clicked, resulting in the following link being sent to the browser: https://www.mysite.com/login/?arm-key=GtSZR%dA3M&email=email@email.it and then the browser performs URL decoding again.

The result is that when the activation link is clicked, it appears expired or invalid.

Changing line 2083 of file "class.arm_members.php" to "$activation_key = wp_generate_password(10 , false);" might resolve the error, perhaps.

Mauro Primon

1 year ago

One vote
Categories
🪲 Bug