[Escalated to 2nd Tier] wpv-forgot-password-form not working correctly

[Author]

Posts

[Luo Yang]

Which duplicator package file can I use?
Please provide the downloadable URL, private message box enabled again

[simonM-5]

Hi Luo

You already have access to our admin via https://toolset.com/forums/topic/wpv-forgot-password-form-not-working-correctly/page/2/#post-2238741.

But so as not to delay this ticket any further, I have created a new package for you. It is called "20211221_nativenannygmbhdev_LUO". You can download it via Duplicator Pro > Packages and install it locally.

Kind regards
Simon

[Luo Yang]

I am downloading the files, will update here if find anything

[Luo Yang]

Sorry for the delay answer, I have tried it again both in my localhost and your website,

The lost password form will post data to the WordPress wp-config.php, in my localhost(fresh WP installation + the latest version of Toolset plugins + WPML plugins), the wp-config.php URL is:
hidden link

But in your website, it is:
hidden link

Are you using custom codes to change the wordPress default login URL?
If it is, where do you put the codes?

[simonM-5]

Hi Luo

No, as far as I am aware, there is no such code on our site. Our users (should) never have access to the wp-login.php page, only to our custom login page "login".

I believe this is a WPML plugin issue.

Kind regards
Simon

[Luo Yang]

You are right, it is an option of WPML, I have done below modifications in your website:
Dashboard-> WPML->Settings-> Multilingual Content Setup
insection "Login and registration pages"
disable option " Allow translating the login and registration pages"

Test it again, I can reset the password correctly, see my screenshot rest-password.JPG

Please test again, check if it is fixed, thanks

[simonM-5]

Hi Luo

We are going live in Germany, therefore we need the password reset process to work in German as well as English.

I have tried this on our dev site with WordPress 5.8 and all the latest Toolset and WPML plugins.
Also tried on our test site, which has been upgraded to 5.9 with all the latest Toolset and WPML plugins.

With said WPML option OFF:

The password reset works fine in English, but not in German (as one might expect from the name of the option):

1) The PW reset email sent out while viewing the site in German is incorrectly sent out in English, as below:

=============
Someone has requested a password reset for the following account:

hidden link

Username: nativenanny2.

If this was a mistake, just ignore this email and nothing will happen.

To reset your password, visit the following address:

hidden link
=============

Note that the first URL is showing /en/ at the end after being sent from the German version of the site, (I would expect /de/) and the 2nd URL is linking correctly to the German version of those pages.

2) On clicking the 2nd URL the link

hidden link

loads, but then is immediately redirected to the English version:

hidden link

2) Performing the PW reset works there in English, but this redirect to English should not be happening.

Furthermore, I am pretty sure that that WPML option is applied to standard WordPress login screens etc. (click the link provided by WPML: https://wpml.org/documentation/getting-started-guide/translating-wordpress-login-and-registration-pages/?utm_source=plugin&utm_medium=gui&utm_campaign=wpmlcore). The screenshots there are showing standard login pages.

We have custom login, password reset, and password change pages built with Toolset, which should also work in any language, as long as they are translated correctly.

Please confer with the WPML team and/or with Christian Cox, who solved a similar issue for us before, before we had migrated our site from a .com to the current .de domain.

Kind regards
Simon

[Nigel Supporter Languages: English (English ) Spanish (Español ) Timezone: Europe/London (GMT+01:00)]

Hi Simon

I noticed your update, and so have spent much of today testing this issue, and can confirm that it is not possible to complete the lost password workflow in a secondary language. The notification email sends a link to the English password reset form. On my local fresh test site, the body of that email is also in English, even though the subject is in the secondary language.

I know that is slightly different than you've experienced, but before trying to account for the differences on your site I need to establish what happens on a clean site.

I'm escalating this to the developers, but this is something that it may take a while to publish a fix for, and I know you have been waiting a very long time already.

So I will continue working on it on Monday to see if I can come up with a workaround or a patch that you can use in the meantime.

I'll update you again.

[simonM-5]

HI Nigel

Thanks very much for this more qualified update. It's good to see that the ticket is finally getting the attentions it requires. Looking forward to hearing from you tomorrow.

Kind regards
Simon

[Luo Yang]

I have marked this thread as Escalated status, will update here if there is anything news.

[Nigel Supporter Languages: English (English ) Spanish (Español ) Timezone: Europe/London (GMT+01:00)]

Hi Simon

I've worked through the plugin source code and can see that the link for the password reset page that gets added to the shortcode wpv-forgot-password-form with the reset_password_url attribute doesn't get offered for translation, and the plugin makes no explicit attempt to handle translated forgot password workflows.

This means that even if you start the workflow in some secondary language, you will always be reverted back to the default language via the link sent out in the notification.

I'm not sure what the best permanent solution should be (I suspect it is that the link should be offered for translation) which I'll leave to the developers.

In the meantime I've produced a patch of a the relevant file which fixes the issue on my local test site.

Can you please test the same on your site?

Download this file: https://toolset.com/patches/wpv-shortcodes.zip, unzip it and replace the file wpv-shortcodes.php in the directory plugins/toolset-blocks/embedded/inc/.

Note this patch was prepared from Blocks 1.6.2, be sure to upgrade to that version first.

If you confirm it works I'll add an erratum with the fix for other users while we wait for a final solution from the developers.

[simonM-5]

HI Nigel

(1) I downloaded your patch and added it our dev server. When I click the link in the email:
hidden link

a browser window opens where I can enter the new desired password twice. However on submission I get the standard WordPress screen and the following URL with invalidkey at the end of the URL:

hidden link

Before introducing the patch, I was at least able to reset successfully in English.

(2) I think WPML also needs to address the fact that the email being sent out to customers is not translated into the secondary language, although we have translated those strings in WPML String Translation. In fact, some may even be WordPress standard translations, although I may have changed them to the informal address form of the German language instead of the formal version, but I cannot be sure any more (see screenshots). I appreciate that this may need to be resolved in another ticket, however thought it was worth mentioning in you are in more direct contact with the right developers already. What would you advise?

Kind regards
Simon

[Nigel Supporter Languages: English (English ) Spanish (Español ) Timezone: Europe/London (GMT+01:00)]

OK, thanks for the feedback. I'll need to try this on a copy of your site locally so I can trace what is happening.

You can re-install blocks to overwrite the patch I provided so that you can use the password reset workflow in English in the meantime.

[simonM-5]

HI Nigel

I've reverted the file back to the original. I imagine that should suffice, rather than reloading the whole plugin.

I've also created a Duplicator package for you. You can download it via

Duplicator Pro > Packages > 20220131_nativenannygmbhdev_TS_WPML_PW

Please let me know once you have been able to download the files successfully, so I can delete them as they pose a security risk.

Thanks and regards
Simon

[Nigel Supporter Languages: English (English ) Spanish (Español ) Timezone: Europe/London (GMT+01:00)]

I've downloaded that, thanks...