<p>If it's just some users, I've seen some email clients split the link with a newline and when users click it, they don't get the full token in the URL producing an invalid one when Craft tries to verify it.</p>

<p>In those cases, it's recommended that the user manually copy and paste the full URL instead of clicking on it.</p>

CC BY-SA 3.0
2017-07-27T18:34:31.130Z
I copied the full token link and paste to the web browser, but I get the same error message.  

I found that it happens most of the time when "Enter your password to continue." message pop up, or system response time is a little bit longer. Does the verification code generated related to time or some session parameters?
Angela Chan
CC BY-SA 3.0
2017-07-27T19:47:53.463Z
I found that this issue is on `_setVerificationCodeOnUserRecord(UserRecord $userRecord)` function return the $unhashedCode in usersServices.php. If $unhashedCode has underscore `"_"`, It gets translate to `"%5C_" (which is \_ )` in the email which makes the code in URL not match with the one in DB.

Since I cannot control the translate in the email system, I would like to replace "_" with another character. What is the best way to do it without touching the core code? Thanks
Angela Chan
CC BY-SA 3.0
2017-07-27T20:12:10.673Z
It's only underscores that are getting encoded? Nothing else? If so, what are your php.ini file's `arg_separator.input` and `arg_separator.output` values set to?
Brad Bell
CC BY-SA 3.0
2017-07-27T21:00:21.963Z
Yes, just underscore `"_"` (so far I don't see any other special character add backslash ) Nothing is set in php.ini on `arg_separator.input` and `arg_separator.output`.
Angela Chan
CC BY-SA 3.0
2017-07-27T22:32:12.927Z
Running out of ideas... maybe it's the email client doing the encoding for some weird reason?
Brad Bell
CC BY-SA 3.0
2017-07-28T02:30:37.997Z
For Temporary fix, I added replacement on `"_"` to `"A"`  by this code : `$unhashedCode = str_replace('_', 'A',$unhashedCode);` in `_setVerificationCodeOnUserRecord(UserRecord $userRecord)`. Just wonder any way to fix that issue without changing the core code. Thanks
Angela Chan
CC BY-SA 3.0
2017-07-27T18:09:55.800Z
2017-07-27T18:09:55.800Z
Brad Bell
<p>I am sending the set Password URL to a user to set their password after ADMIN create a user in CP.</p>

<p>I am using <code>craft()-&gt;users-&gt;getPasswordResetUrl($user)</code> to generate the URL for set password which is look like <code>https://&lt;my domain&gt;/actions/users/setpassword?code=8MHKqfmt6Te%5C_dyuCouL4PMaT%7EE%7EV9jNO&amp;id=8bf376ca-e260-44b9-9ad2-0cc623fe4c4c</code> However, I got intermittent user report they get <strong>"Oops! Invalid verification code. Please login or reset your password."</strong> message pop up after click the link.</p>

<p>In general.php, I have <code>'verificationCodeDuration' =&gt; 'P7D'</code> to make sure the code could last for 7 days.</p>

<p>Does anyone has idea how to verify the code in DB? Looks the verficationCode column in DB is encrypted. Does anyone know how to solve that issue? Thanks</p>

<plugin-development><url><password>
Invalid verification code. Please login or reset your password
# Invalid verification code. Please login or reset your password

(Asked by: username_0 on 2017-07-27)

I am sending the set Password URL to a user to set their password after ADMIN create a user in CP.

I am using `craft()->users->getPasswordResetUrl($user)` to generate the URL for set password which is look like `https:///actions/users/setpassword?code=8MHKqfmt6Te%5C_dyuCouL4PMaT%7EE%7EV9jNO&id=8bf376ca-e260-44b9-9ad2-0cc623fe4c4c` However, I got intermittent user report they get **"Oops! Invalid verification code. Please login or reset your password."** message pop up after click the link.

In general.php, I have `'verificationCodeDuration' => 'P7D'` to make sure the code could last for 7 days.

Does anyone has idea how to verify the code in DB? Looks the verficationCode column in DB is encrypted. Does anyone know how to solve that issue? Thanks

**Tags:** plugin-development, url, password


---

## 1 answers

### Answer by username_1 on 2017-07-27. Score: 1

If it's just some users, I've seen some email clients split the link with a newline and when users click it, they don't get the full token in the URL producing an invalid one when Craft tries to verify it.

In those cases, it's recommended that the user manually copy and paste the full URL instead of clicking on it.

> **Comments:**
> **username_0**: I copied the full token link and paste to the web browser, but I get the same error message.    I found that it happens most of the time when "Enter your password to continue." message pop up, or system response time is a little bit longer. Does the verification code generated related to time or some session parameters?  
> **username_0**: I found that this issue is on `_setVerificationCodeOnUserRecord(UserRecord $userRecord)` function return the $unhashedCode in usersServices.php. If $unhashedCode has underscore `"_"`, It gets translate to `"%5C_" (which is \_ )` in the email which makes the code in URL not match with the one in DB.  Since I cannot control the translate in the email system, I would like to replace "_" with another character. What is the best way to do it without touching the core code? Thanks  
> **username_1**: It's only underscores that are getting encoded? Nothing else? If so, what are your php.ini file's `arg_separator.input` and `arg_separator.output` values set to?  
> **username_0**: Yes, just underscore `"_"` (so far I don't see any other special character add backslash ) Nothing is set in php.ini on `arg_separator.input` and `arg_separator.output`.  
> **username_1**: Running out of ideas... maybe it's the email client doing the encoding for some weird reason?  
> **username_0**: For Temporary fix, I added replacement on `"_"` to `"A"`  by this code : `$unhashedCode = str_replace('_', 'A',$unhashedCode);` in `_setVerificationCodeOnUserRecord(UserRecord $userRecord)`. Just wonder any way to fix that issue without changing the core code. Thanks  

---

