Skip to content

Do not encode URL in href for verification/password reset #34

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
PJB3005 merged 1 commit into from
Jan 19, 2026
Merged

Do not encode URL in href for verification/password reset #34

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions SS14.Auth.Shared/ModelShared.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,20 +11,22 @@ public static class ModelShared
public static async Task SendConfirmEmail(IEmailSender sender, string address, string confirmLink)
{
await sender.SendEmailAsync(address, "Confirm your Space Station 14 account",
$"Please confirm your account by <a href='{HtmlEncoder.Default.Encode(confirmLink)}'>clicking here</a>.");
$"Please confirm your account by <a href='{confirmLink}'>clicking here</a>." +
$"\n<p><small>If the above link is not working, try this one {HtmlEncoder.Default.Encode(confirmLink)}</small></p>");
}

public static async Task SendResetEmail(IEmailSender emailSender, string email, string callbackUrl)
{
await emailSender.SendEmailAsync(
email, "Reset Password",
"A password reset has been requested for your account.<br />" +
$"If you did indeed request this, <a href='{HtmlEncoder.Default.Encode(callbackUrl)}'>click here</a> to reset your password.<br />" +
"If you did not request this, simply ignore this email.");
$"If you did indeed request this, <a href='{callbackUrl}'>click here</a> to reset your password.<br />" +
"If you did not request this, simply ignore this email." +
$"\n<p><small>If the above link is not working, try this one {HtmlEncoder.Default.Encode(callbackUrl)}</small></p");
}

public static SpaceUser CreateNewUser(string userName, string email, ISystemClock systemClock)
{
return new SpaceUser {UserName = userName, Email = email, CreatedTime = systemClock.UtcNow};
}
}
}
5 changes: 2 additions & 3 deletions SS14.Web/Areas/Identity/Pages/Account/ExternalLogin.cshtml.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,8 +139,7 @@ public async Task<IActionResult> OnPostConfirmationAsync(string returnUrl = null
values: new { area = "Identity", userId = userId, code = code },
protocol: Request.Scheme);

await _emailSender.SendEmailAsync(Input.Email, "Confirm your email",
$"Please confirm your account by <a href='{HtmlEncoder.Default.Encode(callbackUrl)}'>clicking here</a>.");
await ModelShared.SendConfirmEmail(_emailSender, Input.Email, callbackUrl);

// If account confirmation is required, we need to show the link if we don't have a real email sender
if (_userManager.Options.SignIn.RequireConfirmedAccount)
Expand All @@ -163,4 +162,4 @@ await _emailSender.SendEmailAsync(Input.Email, "Confirm your email",
ReturnUrl = returnUrl;
return Page();
}
}
}
11 changes: 3 additions & 8 deletions SS14.Web/Areas/Identity/Pages/Account/Manage/Email.cshtml.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.RazorPages;
using Microsoft.AspNetCore.WebUtilities;
using SS14.Auth.Shared;
using SS14.Auth.Shared.Data;
using SS14.Auth.Shared.Emails;

Expand Down Expand Up @@ -100,10 +101,7 @@ public async Task<IActionResult> OnPostChangeEmailAsync()
pageHandler: null,
values: new { userId = userId, email = Input.NewEmail, code = code },
protocol: Request.Scheme);
await _emailSender.SendEmailAsync(
Input.NewEmail,
"Confirm your email",
$"Please confirm your account by <a href='{HtmlEncoder.Default.Encode(callbackUrl)}'>clicking here</a>.");
await ModelShared.SendConfirmEmail(_emailSender, Input.NewEmail, callbackUrl);
await _logManager.LogAndSave(user, new AccountLogEmailChangeRequested(email, Input.NewEmail));

StatusMessage = "Confirmation link to change email sent. Please check your email.";
Expand Down Expand Up @@ -137,10 +135,7 @@ public async Task<IActionResult> OnPostSendVerificationEmailAsync()
pageHandler: null,
values: new { area = "Identity", userId = userId, code = code },
protocol: Request.Scheme);
await _emailSender.SendEmailAsync(
email,
"Confirm your email",
$"Please confirm your account by <a href='{HtmlEncoder.Default.Encode(callbackUrl)}'>clicking here</a>.");
await ModelShared.SendConfirmEmail(_emailSender, email, callbackUrl);

StatusMessage = "Verification email sent. Please check your email.";
return RedirectToPage();
Expand Down