FS#961 resend passwd does not strip special chars in username

ACL & Authentication

• 

  2006-10-31 pnguyen

  During registration, any special characters found in the username are automatically converted by utf8_stripspecials(). With a page separator configuration value of "-", the username of "foo@bar.com" is stored internally as "foo-bar.com". This difference, entered vs. internal usernames, prevents the resend password feature from recognizing usernames containing special characters, such as email addresses. The resulting error is:
  
  Sorry, we can't find this user in our database.
  
  The below fix adds the missing special character conversion in act_resendpwd(), inc/auth.php.
  
  --- auth.php    18 Aug 2006 23:59:22 -0000 1.1.1.5
  +++ auth.php    31 Oct 2006 12:44:05 -0000 1.2
  @@ -585,7 +585,9 @@
        msg($lang['resendpwdmissing'], -1);
        return false;
      } else {
  -      $user = $_POST['login'];
  +      $_POST['login'] = preg_replace('/.*:/','',$_POST['login']);
  +      $_POST['login'] = cleanID($_POST['login']);
  +      $user = $_POST['login'];        
      }
  
      $userinfo = $auth->getUserData($user);
  
• 

  2006-11-04 ChrisS

  patch sent for devel version