adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-03 07:22:22 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Impossible to renew a forgotten password with "+" in email address #761

New Issue
Open
opened 2026-10-05 00:15:56 +02:00 by adam · 3 comments
adam commented 2026-10-05 00:15:56 +02:00
Owner
Copy link
Copy source

If there is a plus sign "+" in the email address (like in user+piwigo@example.com), it's not possible to renew a forgotten password. Piwigo tells that user or password is not valid.

If there is a plus sign "+" in the email address (like in user+piwigo@example.com), it's not possible to renew a forgotten password. Piwigo tells that user or password is not valid. <!-- github-sync-id:300588024 -->
adam commented 2026-10-05 00:15:57 +02:00
Author
Owner
Copy link
Copy source

I just made the test with a user having the "+" sign in its email address. It worked perfectly fine.

Are you sure this user exists? If you user user+piwigo@example.com does not exist in your users table, you will get this message. It's not that the email address is invalid, it's just the Piwigo doesn't find the user matching this email address.

I just made the test with a user having the "+" sign in its email address. It worked perfectly fine. Are you sure this user exists? If you user `user+piwigo@example.com` does not exist in your users table, you will get this message. It's not that the email address is invalid, it's just the Piwigo doesn't find the user matching this email address. <!-- github-comment-id:404459987 -->
adam commented 2026-10-05 00:15:58 +02:00
Author
Owner
Copy link
Copy source

Initial state: a user with User username and user@example.com email address.

Here the procedure followed to reproduce the bug:

  1. Log in on identification.php
  2. On admin.php page, change email address of User to user+piwigo@example.com
  3. Log out
  4. On identification.php, click on the "password forgotten" link
  5. Type user+piwigo@example.com in the email field and click on the "change password" button
  6. Receive an email with a link to renew password
  7. After clicking on link, type the wanted new password two times and click on button
  8. Obtain the error message
  9. Retry and be redirected on landing page
  10. Try to connect on identification.php with the new password. And fail. The precedent password is still active.

The same procedure with user@example.com address works well. After typing the new password two times, Piwigo indicates that password have been changed and propose a link to connect. With success.

Note that the user account used for procedure is an admin account.

Initial state: a user with User username and user@example.com email address. Here the procedure followed to reproduce the bug: 1. Log in on identification.php 2. On admin.php page, change email address of User to user+piwigo@example.com 3. Log out 4. On identification.php, click on the "password forgotten" link 5. Type user+piwigo@example.com in the email field and click on the "change password" button 6. Receive an email with a link to renew password 7. After clicking on link, type the wanted new password two times and click on button 8. Obtain the error message 9. Retry and be redirected on landing page 10. Try to connect on identification.php with the new password. And fail. The precedent password is still active. The same procedure with user@example.com address works well. After typing the new password two times, Piwigo indicates that password have been changed and propose a link to connect. With success. Note that the user account used for procedure is an admin account. <!-- github-comment-id:405524425 -->
adam commented 2026-10-05 00:15:59 +02:00
Author
Owner
Copy link
Copy source

Do you have a security module on your server? Could you try without it?

Le mar. 17 juil. 2018 à 11:45, Cypouz notifications@github.com a écrit :

Initial state: a user with User username and user@example.com email
address.

Here the procedure followed to reproduce the bug:

  1. Log in on identification.php
  2. On admin.php page, change email address of User to
    user+piwigo@example.com
  3. Log out
  4. On identification.php, click on the "password forgotten" link
  5. Type user+piwigo@example.com in the email field and click on the
    "change password" button
  6. Receive an email with a link to renew password
  7. After clicking on link, type the wanted new password two times and
    click on button
  8. Obtain the error message
  9. Retry and be redirected on landing page
  10. Try to connect on identification.php with the new password. And
    fail. The precedent password is still active.

The same procedure with user@example.com address works well. After typing
the new password two times, Piwigo indicates that password have been
changed and propose a link to connect. With success.

Note that the user account used for procedure is an admin account.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/Piwigo/Piwigo/issues/842#issuecomment-405524425, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AAs-jTb2PFi8YGoC5FDJXgNpFGEGY6Fnks5uHbIvgaJpZM4SUwON
.

Do you have a security module on your server? Could you try without it? Le mar. 17 juil. 2018 à 11:45, Cypouz <notifications@github.com> a écrit : > Initial state: a user with User username and user@example.com email > address. > > Here the procedure followed to reproduce the bug: > > 1. Log in on identification.php > 2. On admin.php page, change email address of User to > user+piwigo@example.com > 3. Log out > 4. On identification.php, click on the "password forgotten" link > 5. Type user+piwigo@example.com in the email field and click on the > "change password" button > 6. Receive an email with a link to renew password > 7. After clicking on link, type the wanted new password two times and > click on button > 8. Obtain the error message > 9. Retry and be redirected on landing page > 10. Try to connect on identification.php with the new password. And > fail. The precedent password is still active. > > The same procedure with user@example.com address works well. After typing > the new password two times, Piwigo indicates that password have been > changed and propose a link to connect. With success. > > Note that the user account used for procedure is an admin account. > > — > You are receiving this because you are subscribed to this thread. > Reply to this email directly, view it on GitHub > <https://github.com/Piwigo/Piwigo/issues/842#issuecomment-405524425>, or mute > the thread > <https://github.com/notifications/unsubscribe-auth/AAs-jTb2PFi8YGoC5FDJXgNpFGEGY6Fnks5uHbIvgaJpZM4SUwON> > . > <!-- github-comment-id:405539120 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#761