Ticket #1128 (new defect)

Opened 3 years ago

users with + in email address are given invalid verification URLs

Reported by: russ Assigned to: rich
Priority: medium Milestone:
Component: ambra-sso Version: 0.9.1_rc1
Keywords: ambra-registration Cc:
Blocking: Blocked By:

Description

when a user creates an account with ambra-registration, they are sent a verification email with a link to use to verify the email address.

if the email address contains a plus sign, we fail to encode it, and the verification URL results in a site error.

example, with (perfectly valid) email address a+b@example.org

/ambra-registration/emailVerification.action?loginName=a+b@example.com&emailVerificationToken=XXX

the plus sign should be encoded as %2B

/ambra-registration/emailVerification.action?loginName=a%2Bb@example.com&emailVerificationToken=XXX

i've tested that the encoded version works.

we should really just url encode the entire query string here. probably very easy to do in freemarker.

please note:

Dependency Graph