Topic: [Bug] Wrong user profile directed to by link in password reset e-mail

Posted under Site Bug Reports & Feature Requests

Bug overview description.
The user profile directing link in the password reset e-mail is created using the username of the account. User profiles are directed to each by account number and username. Numerical usernames direct to the wrong user profile having the account number of the username used to generate the link.

Example:
Both the following links direct to the user profile of Vesdus
https://e621.net/user/show/Vesdus
https://e621.net/user/show/214365

The following link directs to my user profile only:
https://e621.net/user/show/117366

What part(s) of the site page(s) are affected?
Password reset e-mail, any other places where usernames are used to generate profile directed links

What is the expected behavior?
A url would direct the user to the profile of the account that the password reset is for.

What actual behavior is given instead?
Directs the user to a wrong profile by account # if the account name is only numerical

Time of incident (if applicable).
N/A

Can you reproduce the bug every time?
Yes, it was the same last time I did a password reset and I generated another password reset e-mail before writing this report to confirm.

What steps did you take to replicate this bug?
Generate a password reset e-mail using the link found in the login panel and check the link.

Errors or other messages returned (if any).
None

Updated by Xch3l

Your username is all numbers, so you can't use the username method as it overlaps with the id method.

Sounds like I need to swap the reset link to use ids and not usernames. Wooeoooo.

Updated by anonymous

This would literally break the other guys profile if we "fixed" it.

Updated by anonymous

  • 1