09-29-2016, 09:13 AM
Hey Brian, The fix did not work for me. What worked was just changing line 53 in forgot_password.php from
$encoded_email=rawurlencode($email); to $encoded_email=$email; I left everything else the the way it was and when I received the email I could see that the email address in the link was url encoded correctly. By removing the rawurlencode for the email, isn't that removing the security for the forgot password form and could't someone try to pass in some scripting?
$encoded_email=rawurlencode($email); to $encoded_email=$email; I left everything else the the way it was and when I received the email I could see that the email address in the link was url encoded correctly. By removing the rawurlencode for the email, isn't that removing the security for the forgot password form and could't someone try to pass in some scripting?