ether/pad — Issue #316: Etherpad does not URL encode temporary passwords when sending out invite email
Author: gerv
Created: 2012-02-21 14:21:35+00:00
State: open

I recently got this email:

Dear gerv,

has created an account for you on . You can sign in by clicking on the following link:

https:///ep/account/sign-in?uid=1822&tp=3+ninE=12

Note the "+" sign in the temporary password (tp). These should be URL encoded. Otherwise, my web browser interprets the "+" as a space, and the password gets mangled, and I get an error:

"That password reset link that is no longer valid. (Bad temp pass.)"

Hand URL-encoding the "+" (and the "=") made it work. So you need to call a URL encoder on the tp value before writing it out in the URL in the email.

I don't know how to tell which version of Etherpad this is; if you tell me how to find out, I will.

Gerv