Page MenuHomePhabricator

Link to preferences in password reset emails do not include URL protocol
Closed, ResolvedPublicBUG REPORT

Description

See rMW includes/auth/TemporaryPasswordPrimaryAuthenticationProvider.php (Line 487)

$url omits the URL protocol (http or https) because it uses getFullURL(); resulting in //lang.wikiproject.org/etc-type URLs.

I guess it needs to be changed to getCanonicalURL() instead.

Event Timeline

MarcoAurelio changed the subtype of this task from "Task" to "Bug Report".Dec 22 2020, 7:45 PM
Reedy added subscribers: MaxSem, Reedy.

This confused me, so tested it

However, if you did not generate this request and want to prevent unsolicited
emails, you may want to update your email options at
<//en.wikipedia.org/wiki/Special:Preferences#mw-prefsection-personal-email>.
You can require both username and email address to generate password reset
emails. This may reduce the number of such incidents.

The link at the start is fine

Someone (probably you, from IP address <REDACTED>) requested a reset of your
password for Wikipedia (<https://en.wikipedia.org/wiki/Main_Page>). The following user account is
associated with this email address:

Caused by T233969: Update Temporary Password Email with Preference Info [x-small], rMWd1604f7445c1: Mention requiring email address in password reset emails by @MaxSem

Change 651678 had a related patch set uploaded (by Reedy; owner: Reedy):
[mediawiki/core@master] Fix display of Special:Preferences url in password reset email

https://gerrit.wikimedia.org/r/651678

Change 651603 had a related patch set uploaded (by Reedy; owner: Reedy):
[mediawiki/core@REL1_35] Fix display of Special:Preferences url in password reset email

https://gerrit.wikimedia.org/r/651603

And for confirmation

reedy@deploy1001:~$ mwscript eval.php enwiki
> var_dump( SpecialPage::getTitleFor( 'Preferences', false, 'mw-prefsection-personal-email' )->getFullURL(), SpecialPage::getTitleFor( 'Preferences', false, 'mw-prefsection-personal-email' )->getCanonicalURL() );
string(73) "//en.wikipedia.org/wiki/Special:Preferences#mw-prefsection-personal-email"
string(79) "https://en.wikipedia.org/wiki/Special:Preferences#mw-prefsection-personal-email"

Change 651678 merged by jenkins-bot:
[mediawiki/core@master] Fix display of Special:Preferences url in password reset email

https://gerrit.wikimedia.org/r/651678

Reedy claimed this task.
Reedy triaged this task as Low priority.

Change 651603 merged by jenkins-bot:
[mediawiki/core@REL1_35] Fix display of Special:Preferences url in password reset email

https://gerrit.wikimedia.org/r/651603