Reporting back.
My husband was able to log in under my username on his machine and a proper e-mail was generated, which came to my inbox, allowing me to reset my password, although I had to go through a few additional steps with cut and paste, etc. to complete the process.
So, I am back as Admin with a working password.
However, the problem still exists for me using this OSX laptop and for others who lose their password and get the invalid key message. They can’t get in.
Explanation and code below is what my DH noted and what we need to figure out to fix the problem with Forgot Password :
After following the link, setting and confirming the new password, we get the following page (leaving out the extraneous <head/> stuff).
———
<body class=”login login-action-resetpass wp-core-ui”>
<div id=”login”>
<h1>Carroll Garden Club</h1>
<p class=”message reset-pass”>Your password has been reset. Log in</p>
<p id=”backtoblog”>← Back to Carroll Garden Club</p>
</div>
<link rel=’stylesheet’ id=’wp-publication-archive-frontend-css’ href=’https://carrollgardenclub.org/wp-content/plugins/wp-publication-archive/includes/front-end.css?ver=3′ type=’text/css’ media=’all’ />
<script type=’text/javascript’ src=’https://carrollgardenclub.org/wp-content/plugins/sem-subscribe-me/js/scripts.js?ver=20090906′></script>
<div class=”clear”></div>
</body>
———
Note that the value of the href attribute is “”. This is supposed to be “https://hostname/wp-login.php”. Why it works on my husband’s site, and not mine, we don’t understand. He suspects apply_filters().
The faulty link seems to be coming from the following line of code.
login_header( __( ‘Password Reset’ ), ‘<p class=”message reset-pass”>’ . __( ‘Your password has been reset.’ ) . ‘ ‘ . __( ‘Log in’ ) . ‘</p>’ );
This comes from the following code block in wp-login.php.
———-
<?php
login_footer(‘user_login’);
break;
case ‘resetpass’ :
case ‘rp’ :
$user = check_password_reset_key($_GET[‘key’], $_GET[‘login’]);
if ( is_wp_error($user) ) {
wp_redirect( site_url(‘wp-login.php?action=lostpassword&error=invalidkey’) );
exit;
}
$errors = new WP_Error();
if ( isset($_POST[‘pass1’]) && $_POST[‘pass1’] != $_POST[‘pass2’] )
$errors->add( ‘password_reset_mismatch’, __( ‘The passwords do not match.’ ) );
do_action( ‘validate_password_reset’, $errors, $user );
if ( ( ! $errors->get_error_code() ) && isset( $_POST[‘pass1’] ) && !empty( $_POST[‘pass1’] ) ) {
reset_password($user, $_POST[‘pass1’]);
login_header( __( ‘Password Reset’ ), ‘<p class=”message reset-pass”>’ . __( ‘Your password has been reset.’ ) . ‘ ‘ . __( ‘Log in’ ) . ‘</p>’ );
login_footer();
exit;
}
wp_enqueue_script(‘utils’);
wp_enqueue_script(‘user-profile’);
login_header(__(‘Reset Password’), ‘<p class=”message reset-pass”>’ . __(‘Enter your new password below.’) . ‘</p>’, $errors );
?>
