2

Wordpress 3.2.1 - The reset password URL in the email generated by http://mysite.com/wp-login.php?action=lostpassword does not contain a valid key and so users are unable to reset their password.

We do have Register Plus Redux plugin installed but the problem persists even if I disable it. Is this a known issue?

Clicking the link gives the error "Sorry, that key does not appear to be valid." The link looks like this:

http://mysite.com/wp-login.php?action=rp&key=&login=email%40mysite.com (they key is empty)

2
  • What do you see if you echo wp_generate_password(20, false); ? (this is how that key is generated) Sep 28, 2011 at 11:06
  • Was the key generated with that plugin still on? Because it could be that that plugin screwed it up, in which case they'd have to generate a new key... Sep 28, 2011 at 11:25

1 Answer 1

2

The site's original developer was using the reset_password_message filter and had either done it incorrectly or the core code has changed. The following function now works:

function reset_password_message( $message, $key ) {

    if ( strpos($_POST['user_login'], '@') ) {
        $user_data = get_user_by('email', trim($_POST['user_login']));
    } else {
        $login = trim($_POST['user_login']);
        $user_data = get_user_by('login', $login);
    }

    $user_login = $user_data->user_login;

    $msg = __('The password for the following account has been requested to be reset:'). "\r\n\r\n";
    $msg .= network_site_url() . "\r\n\r\n";
    $msg .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n";
    $msg .= __('If this message was sent in error, please ignore this email.') . "\r\n\r\n";
    $msg .= __('To reset your password, visit the following address:');
    $msg .= '<' . network_site_url("wp-login.php?action=rp&key=$key&login=" . rawurlencode($user_login), 'login') . ">\r\n";

    return $msg;

}

add_filter('retrieve_password_message', reset_password_message, null, 2);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.