Invalid password reset link for SOME users

  • Resolved foxladi

    (@foxladi)


    4 years, 9 months ago

    Hi,

    I got several hundred new users to my course platform, and a couple of them reported back that they got “Invalid password reset link” when they tried to reset their password.

    I can confirm that when I click their links (they top-posted over the quoted email).

    Then I used one of my own test users and that password reset link worked. As do so many other students’.

    I noticed that the two users who got the invalid link both had long usernames.

    One with 14 characters, the other one with 18, while my own test user only had 8 characters in the user name.

    I have disabled Litecache – no effect.
    I have disabled bunny.net – no effect.
    I have changed from Astra theme to the default – no effect.
    I have disabled all other plugins – no effect.

    I don’t have WooCommerce installed.
    I have no other cache installed, nor

    The page I need help with: [log in to see the link]

Viewing 7 replies - 1 through 7 (of 7 total)
  • Thread Starter foxladi

    (@foxladi)

    4 years, 9 months ago

    Update:

    I figured that I could test it by making a user with a long usename. I chose brittmalkavoopticomtest

    I got Invalid Password Reset Link.

    Then I changed the username to “voopti” directly in the database, created a new password reset request, and it worked.

    So there seems to be a bug with long usernames. How long? 8 characters are fine, but I don’t know the max. If you could figure that out, it would be great.

    Plugin Author Uncanny Owl

    (@uncannyowl)

    4 years, 9 months ago

    Hi @foxladi , sorry to hear about the issue.

    On our side, we can definitely confirm nothing would be affected by length of username. We and thousands of sites often use email addresses as usernames, which can get very long (much longer than your example).

    It could be another plugin setting restrictions or a conflict. Another possibility is environment restrictions that limit key/URL length and perhaps that is blocking long usernames. On that note, it would be good to check the PHP error log to see if any related errors are showing up. We would also recommend disabling our module (perhaps on a Staging site) to see if the behaviour is different with stock LearnDash login and password reset functions. Perhaps it’s even a security plugin blocking certain types of login attempts? (If you have one, you should try disabling it temporarily).

    Let’s see if the tests above get us closer to a resolution.

    Thread Starter foxladi

    (@foxladi)

    4 years, 8 months ago

    Hi @uncannyowl

    It could be another plugin, yes. You mention this twice…

    But as already stated in my first message:

    I have disabled all other plugins – no effect.

    I don’t have a staging site, and I have no idea about how to make one.

    If there is environment restrictions that limit key/URL length… would this be visible somewhere? PHP.ini or something?

    Where do I find the PHP error log?

    Plugin Author Uncanny Owl

    (@uncannyowl)

    4 years, 8 months ago

    Hi @foxladi , it sounds like it would be a good idea to talk to your host as a next step. They can direct you to your error log (the location can vary by host) and whether they offer a Staging environment (on LearnDash sites it’s always a good idea to have a Staging site for testing updates before deploying them on a live site).

    It might also be a good idea to move this to a ticket on our website, as we are now curious about your hosting provider and it would be a safer way to provide us with your error log (when you’re able to locate it).

    Thread Starter foxladi

    (@foxladi)

    4 years, 8 months ago

    I found the php error log. Lots of errors… Mostly with the thrive-learndash plugin.

    I don’t think I can open a ticket on your website, because I’m not a premium user.

    Thanks for trying to help.

    Plugin Author Uncanny Owl

    (@uncannyowl)

    4 years, 8 months ago

    Hi @foxladi , it’s no problem, just submit any contact form on our site and it will create your submission as a ticket.

    Interesting about the Thrive/LearnDash plugin, we haven’t used it. It would definitely be great to have a look if you are able to provide the log and results of a Staging site conflict test via our website (if you can get that set up).

    Thread Starter foxladi

    (@foxladi)

    4 years, 8 months ago

    Done, thank you very much 🙂

Viewing 7 replies - 1 through 7 (of 7 total)

The topic ‘Invalid password reset link for SOME users’ is closed to new replies.