1

I am trying create passowrd reset form. Here is my function:

<?php 
$user_data = get_user_by( 'email', 'admin@mysite.com' ) );
$key = get_password_reset_key( $user_data );
$user_login = $user_data->user_login;

$message = esc_url( get_permalink( '1' ) . "?action=rp&key=$key&login=" . rawurlencode($user_login) ) . "\r\n";

wp_mail( $user_email, "Title", $message );
?>

It sends reset link to my mail, with $key and $login. It is ok.

Now i must check the reset key. Here is my code:

<?php 
$errors = new WP_Error();
$user = check_password_reset_key($_GET['key'], $_GET['login']);

if ( is_wp_error( $user ) ) {
    if ( $user->get_error_code() === 'expired_key' )
        echo "Key is expired";
    else
        echo "Key is not valid";
}
?>

But it always says Key is not valid. Where is wrong?

  • 1
    In the else, try to echo the $user->get_error_message() instead of "Key is not valid", and see what it says. – Sally CJ Feb 26 '18 at 7:09
  • It says invalid key @Sally – bilimokur Feb 26 '18 at 17:32
  • Try $user = check_password_reset_key($_GET['key'], rawurldecode($_GET['login'])); because you rawurlencode() the login in the email. If that doesn't work, do var_dump( $_GET['key'], $_GET['login'] ); and see if the values are valid. – Sally CJ Feb 26 '18 at 17:39
  • Yes. I found the problem. Php is not reads $_GET valuse. Because url is wrong. localhost/wordpress/reset-pass-page//… #038; why it add this #038; ? – bilimokur Feb 26 '18 at 17:56
  • Because that's how esc_url() works. I.e. By default, it converts &amp; to &#038;. Sorry that I didn't really notice (or pay attention to) the wp_mail() part. =) – Sally CJ Feb 26 '18 at 19:32
2

I fixed it. We need decode url with esc_url_raw. Here is solution.

<?php 
$user_data = get_user_by( 'email', 'admin@mysite.com' ) );
$key = get_password_reset_key( $user_data );
$user_login = $user_data->user_login;

$url = esc_url_raw( get_permalink( '1' ) . "?action=rp&key=$key&login=" . rawurlencode($user_login) ) . "\r\n";
$message = $url;

wp_mail( $user_email, "Title", $message );
?>
  • 1
    Actually, you could just define $url like this: $url = esc_url_raw( get_permalink( '1' ) . "?action=rp&key=$key&login=$user_login" );. I.e. No need to rawurlencode($user_login) or do the htmlspecialchars_decode() part. =) – Sally CJ Feb 26 '18 at 19:33
  • It's my pleasure helping you! =) – Sally CJ Feb 27 '18 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.