All works fine, nothing is broken in all our test websites. I have no idea what you mean saying two factor login, please provide more information with a separate topic. All issues you're talking about are your site specific issues, they are not general issues. There will not be further releases for this issue. The registration issue is fixed so please don't wait for news here and update it to the latest version.

This topic is closed.

Sorry yooda120 but is very difficult to tell from your posts, are you saying although 1.4.13 has fixed the registration fault it has now introduced another? If this is true this really is poor.

I've not updated and have no intention of doing so until things are clearer. 

Yes.. It fix one thing and broke another at least on my site ..

Is there a way to get back 1.4.8 ?

I've not updated and have no intention of doing so until things are clearer. 

but after i log in... He throws me out in a second so i can realy do nothing... 🤣  🤣  🤣 

BTW Tow-factor are not realy works at all, Nothing send to my mail after log in :)

I see 1.4.13 states it fixes registration which is great. However I'm not applying the release until there is some feedback about this latest release from others in this community who have applied and if it is clear of any additional bugs. I don't have a test server, so if anyone has applied it who had the registration bug has it fixed it? Is everything else working as before?

We're currently checking all issues related to user registration and password reset emails/links

It's an issue within this file:

/wp-content/plugins/wpforo/wpf-includes/wpf-hooks.php

First off, line 1923 in the wpforo_redirect_to_custom_password_reset function the key is sanitized in the check_password_reset_key function of WP. However it should be safe to remove that line since it's seemingly unnecessary.

Line 1924 is the real issue. It sets $_REQUEST to an attempt to sanitize $_REQUEST which it should actually use the sanitize_user function for anyway, though I'm not completely certain that value is actually used anywhere or not, but it does seem to at least check if it's empty. It should really be setting $_REQUEST instead of $_REQUEST or perhaps better yet pass the values directly to the check_password_reset_key function below.

In fact I would be inclined to change that entire section from:

        // Verify key / login combo
        $_REQUEST = sanitize_textarea_field($_REQUEST);
        $_REQUEST = sanitize_textarea_field($_REQUEST);
        $user = check_password_reset_key( $_REQUEST, $_REQUEST );
        if ( ! $user || is_wp_error( $user ) ) {
            if ( $user && $user->get_error_code() === 'expired_key' ) {
                WPF()->notice->add('The key is expired', 'error');
            } else {
                WPF()->notice->add('The key is invalid', 'error');
            }
            wp_redirect( wpforo_login_url() );
            exit;
        }

To:

        // Verify key / login combo
        $user = check_password_reset_key( $_REQUEST, sanitize_user($_REQUEST) );
        if ( is_wp_error( $user ) ) {
            WPF()->notice->add($user->get_error_message(), 'error');
            wp_redirect( wpforo_login_url() );
            exit;
        }

It will now properly validate the key and redirect the user to the password reset form.

Also note that there is a similar block of code in futher on in that file within the wpforo_do_password_reset function, though it uses it's own variables properly there. This is at line 1975 or 1969 after the above modification.

I wish the code was published somewhere like GitHub so people could more easily contribute and submit pull requests and whatnot.