Reported by Ali: FreeREG password reset emails are coming through with link in plain text.

[Vino-S]

[DeniseColbert]

Vino couldn't reproduce, Dale and Joseph to see if they can.

[stsccfr]

Ali says that she uses Gmail. Interestingly, when she forwarded the email she received to me (I also use Gmail) the link was active. But that might be due to what Gmail does when forwarding, as opposed to receiving. Anyway, we should discuss sending out email as html rather than plain text.

[jayto581]

Was unable to recreate reported Gmail behaviour

Please provide more information for us to investigate further:
What is the device you are using?
Does the behaviour persist when using a different device?
Is the link clickable?
Does it open in a new window/tab?
Does it always behave this way or is this a one time occurrence?
How was the Gmail accessed? using a browser, mobile app, tablet app?
If using a browser, which one? Chrome, Firefox, Edge, Internet Explorer, Opera, etc
What version of the browser?
Are there any browser extension or plugin installed that may disable the link?
What operating system? Windows, Apple, Android, etc
What version of the operation system?

[stsccfr]

I can reproduce this problem now. We definitely need to clean this up, but there still may be a dependence on the mail program. Ali corrected herself and said she was using Thunderbird to view the email, not Gmail, but I also had her describe how she was getting the email to be sent, and that was the key. We've got two places for sending password resets, and they work differently. I did it by going to my user profile page and clicking the button to send an email for a password reset (but of course this means I was already logged in). Ali did it by clicking the link for "I forgot my password" on the FreeREG login page (which means she was not logged in). The emails sent are completely different in terms of wording and formatting. If sent from my Profile page, the link I receive in Thunderbird looks like this:

<p><a href="https://www.freereg.org.uk/cms/refinery/users/password/edit?reset_password_token=XXwQCZ6S73-fzjw4Zs">Change my password</a></p>

But if sent from the login page the link looks like:

<p>http://www.freereg.org.uk/cms/refinery/users/password/edit?reset_password_token=TTnWkpiCJzkvDp5Dxy-</p>

So we're missing the <a href> in the second case, but there's something else that's a bit bothersome, and that is that in the first case the link is https while in the second its http. Shouldn't we always be using https nowadays?

[DeniseColbert]

Plan: Remove reliance on Refinery authentication so that https is enabled

This will take some time so placing 'On Ice'