- This topic has 11 replies, 4 voices, and was last updated 3 years, 6 months ago by
.
-
Posts
-
We’ve run into an issue with the message being displayed when testing the reset password via email link. After resetting the password the message states “Password Reset Successful. Please Log In Error! The password reset key is invalid. Please generate a new request.” After further testing we were able to find you are able to log-in with the newly reset password. We were able to find the php file, “reset_password_using_link”, which is responsible for the message generation. It is not clear where we can prevent the error message from being displayed on a successful password reset. We found that the php file “class.simple-wp-membership” has a function on line 945 responsible for the check, but we were not sure. Can you provide any more insights?
We’ve run into an issue with the message being displayed when testing the reset password via email link.
You are doing this test on a “live” system; and not on any sandboxed or localhost?
We were able to find the php file, “reset_password_using_link”, which is responsible for the message generation. It is not clear where we can prevent the error message from being displayed on a successful password reset. We found that the php file “class.simple-wp-membership” has a function on line 945 responsible for the check,
You’re obviously an advanced user, so I’m going to ask you this… can you insert some kind of breakpoint or counter to ensure the function is only being called once, per click? Sometimes, a browser or antivirus extension will try prefetching a page link; which “counts” as a click. More than 1 click, and you’re out.
I am having the same exact problem. Using the “Forgot Password” option with a reset link configured, this is what I get after changing the password…
Password Reset Successful. Please Log In
Error! The password reset key is invalid. Please generate a new request.The password reset worked, but this error message is presented anyway. Please advise.
In fact I narrowed it down to the code file below at line 8
/opt/bitnami/wordpress/wp-content/plugins/simple-membership/views
…
if ( is_wp_error( $is_valid_key ) ) {
$error_message = __(“Error! The password reset key is invalid. Please generate a new request.”, “simple-membership”);
//echo $is_valid_key->get_error_message();
echo ‘<div class=”swpm-pw-reset-key-invalid-error swpm-red-error-text”>’;
echo $error_message;
echo ‘</div>’;
return;
}Looks like this wordpress routine is not working in the context of this plugin. It makes me wonder if the password reset is secure?
https://developer.wordpress.org/reference/functions/check_password_reset_key/
Anyone have any ideas?
Yeah, I noticed two new versions since I posted my issue. Unfortunately, it is not fixed. I also confirmed that the page is not being refreshed twice or anything like that, which would probably cause the error to rightly show in that case. So, I am not sure. Any help would be appreciated. This must be affecting many other people since it is a pretty basic site with only a handful of common plugins be used.
I was able to test further after updating from 4.2.6 to 4.2.9 but the issue is still persisting. Seems like whatever the checking function for a valid password reset isn’t working as intended still. Hopefully the team can track this issue down better than I can. If I am able to resolve myself I’ll be sure to update.
Cool. Thanks Clay for trying it out. I appreciate the support.
Also, I installed the Simple Membership reCaptcha Plugin and tried it again. That did not fix it.
The issue was resolved by updating the file “reset_password_using_link.php” with the following code snippet beginning on line 8 of the file.
Just note that if there is an update this plugin you will need to re-apply this change to the file again.
if ( is_wp_error( $is_valid_key ) ) {//added this line to prevent the error msg below from showing after a successful pwd reset (yet still show other potential errors further below)
if ( $_SERVER[‘REQUEST_METHOD’] == ‘POST’ && empty(get_transient(“swpm-passsword-reset-error”)) ) return;$error_message = __(“Error! The password reset key is invalid. Please generate a new request.”, “simple-membership”);
//echo $is_valid_key->get_error_message();
echo ‘<div class=”swpm-pw-reset-key-invalid-error swpm-red-error-text”>’;
echo $error_message;
echo ‘</div>’;
return;
}Thank you. I will apply a fix for this in the next release of the plugin. In the meantime, you can use the following copy of the plugin where I have already applied the fix:
https://simple-membership-plugin.com/wp-content/uploads/simple-membership.zip
- You must be logged in to reply to this topic.