From bb5765e951b2d764fd67a135c930cb5ad7ff134a Mon Sep 17 00:00:00 2001 From: Sergey Biryukov Date: Sat, 18 Jan 2020 02:32:06 +0000 Subject: [PATCH] Mail: Remove angle brackets from password reset URL in emails sent by `retrieve_password()` and `wp_new_user_notification()`. The brackets were originally added in [16285] per W3C recommendation in https://www.w3.org/Addressing/URL/5.1_Wrappers.html to avoid wrapping the URL across multiple lines in plain text in older email clients. This doesn't seem like a common issue in modern email clients, and the current implementation causes more issues than it solves. Since the URL is on a line by itself, it should not require any delimiters. The URL in recovery mode email introduced in [44973] doesn't have angle brackets, so it's time to retire them in password reset email too if they're not used consistently. Props donmhico, Otto42, sproutchris, iandunn, dd32, DaveWP196, sebastian.pisula, tommix, sablednah, julian.kimmig, Rahe, clayisland, arenddeboer, nicole2292, nagoke, squarecandy, eatingrules, SergeyBiryukov. Fixes #21095, #23578, #44589. Built from https://develop.svn.wordpress.org/trunk@47086 git-svn-id: http://core.svn.wordpress.org/trunk@46886 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/pluggable.php | 2 +- wp-includes/version.php | 2 +- wp-login.php | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php index 933e127abe..a741ac4e78 100644 --- a/wp-includes/pluggable.php +++ b/wp-includes/pluggable.php @@ -2016,7 +2016,7 @@ if ( ! function_exists( 'wp_new_user_notification' ) ) : /* translators: %s: User login. */ $message = sprintf( __( 'Username: %s' ), $user->user_login ) . "\r\n\r\n"; $message .= __( 'To set your password, visit the following address:' ) . "\r\n\r\n"; - $message .= '<' . network_site_url( "wp-login.php?action=rp&key=$key&login=" . rawurlencode( $user->user_login ), 'login' ) . ">\r\n\r\n"; + $message .= network_site_url( "wp-login.php?action=rp&key=$key&login=" . rawurlencode( $user->user_login ), 'login' ) . "\r\n\r\n"; $message .= wp_login_url() . "\r\n"; diff --git a/wp-includes/version.php b/wp-includes/version.php index 9b4193637f..7bfae047fd 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -13,7 +13,7 @@ * * @global string $wp_version */ -$wp_version = '5.4-alpha-47085'; +$wp_version = '5.4-alpha-47086'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. diff --git a/wp-login.php b/wp-login.php index 51c8804bdb..db739eddad 100644 --- a/wp-login.php +++ b/wp-login.php @@ -426,7 +426,7 @@ function retrieve_password() { $message .= sprintf( __( 'Username: %s' ), $user_login ) . "\r\n\r\n"; $message .= __( 'If this was a mistake, just ignore this email and nothing will happen.' ) . "\r\n\r\n"; $message .= __( 'To reset your password, visit the following address:' ) . "\r\n\r\n"; - $message .= '<' . network_site_url( "wp-login.php?action=rp&key=$key&login=" . rawurlencode( $user_login ), 'login' ) . ">\r\n"; + $message .= network_site_url( "wp-login.php?action=rp&key=$key&login=" . rawurlencode( $user_login ), 'login' ) . "\r\n"; /* translators: Password reset notification email subject. %s: Site title. */ $title = sprintf( __( '[%s] Password Reset' ), $site_name );