14 August 2017, 16:22

We are on 16.10.2 and on forgotpass.php, hyperlinks do not get rendered from the language files. That is, we get the error message of:

"The user you requested uses an external authentication method. <a href="https://myportfolio.aut.ac.nz/contact.php">Ask your administrator</a> for help with changing your password. Or provide another username or email address."

Which is the standard message however it is not hyperlinking the a tags. Is this functioning as designed?

05 September 2017, 7:45

Hi Jawyei

Normally when we display form errors we escape the string by default as the error sometimes contains user entered information - this is done for security reasons.

In this case the string is generated from values that are hard coded within Mahara itself and so the escaping can be ignored.

The message is passed through $form->set_error() and this takes a third parameter true/false in regards to escaping the string.

So adding 'false' to the end of line 114 in forgotpass.php should sort the problem.

Do you want to give that a go and make a patch if it works?

Cheers

Robert

05 September 2017, 9:42

Hi Robert

That did the trick. I would not have worked that one out myself.