Problem with “reset password” feature

Hi all,

I have some problems with the reset password feature: when I ask a new password via the “Lost password” link in “wp-login.php”, I recieve a confirmation link with a key to validate the reset of my password.

The problem is that it appear the key is often invalid (“invalid key” error). After searching in the code I noticed some strange things.

In “wp-login.php”, we have the code $key = wp_generate_password(); to generate a key. When I look in the wp_generate_password function, I see $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()"; which enumerate all characters allowed in the key or password.

Back in “wp-login.php” (when we click on the confirmation link), we have in the reset_password() function: $key = preg_replace('/[^a-z0-9]/i', '', $key);.

So once we can have a lot of characters allowed to generate the key/password but at the end, only alphanum chars are taken in account.

Is it a bug, does I have missied something ? In my case and for the moment, I’ll comment the preg_replace in the reset_password function.

David