I've checked and the escaping of username doesn't affect the reset password process.

In any case we just updated wpForo core in wordpress.org plugin directory without new version release. You can deactivate, delete wpForo, search and install it again to have escaped usernames in reset password URL.

action=rp&key=mkHcy4Q8xAQItQ0mlLKQ&login=John%20Smith

When a member has a user name like John Smith the password reset link is sent like this

=resetpassword&rp_key=JKN7EUdcBC8wPDoUVzGn&rp_login=John Smith

Notice that "Smith" is not part of the url so when user clicks on the url they are taken to non existent "John" profile which of course will throw an error because the key will not match the username/email

I just tested with usernames with spaces and all works fine. Please let me know what issue you mean?

Thanks Robert,

The link is now contained in the email. But, we are back to usernames with spaces in them not being escaped..

@verek

Please explain, what do you mean saying "not being escaped"? Have you clicked on the URL? Do you see any issue with that?

I'm totally confused!

My installation of 1.4.8 never had a problem with the password link being missing from the e-mail. I'm still on 1.4.8 and I just tested it, all is OK the link in the e-mail is present. So how does the 1.4.9 update, fix that which is not broken? 

I notice that on your forum here, if I click on the forgot password link it no longer uses the Wpforo routine as it did before, it now defaults to the wordpress forgot password routine, is that by choice, mistake or fault?

I fail to see why the missing e-mail link would impact some wpforo installations and not others.

I'm certainly loathed to install 1.4.9 in case it introduces yet another bug as raised by @verek above. Until I'm clear as to what is going I'll leave it. And will there be a 1.4.9.a released to re-fix the username with spaces not being escaped?

As I say, all very confusing

The link is now contained in the email. But, we are back to usernames with spaces in them not being escaped..

wpForo 1.4.9 is released. The issue related to reset password link should be fixed. Please update and check it again.