Add missing encodeURIComponent on username password reset (#6278)

* Add missing encodeURIComponent on username * Add new unit test on encoded username password reset redirect
2019-12-17 03:15:29 +01:00
parent 2d665c96a3
commit d9f36b060e
2 changed files with 66 additions and 6 deletions
--- a/src/Routers/PublicAPIRouter.js
+++ b/src/Routers/PublicAPIRouter.js
@@ -212,13 +212,14 @@ export class PublicAPIRouter extends PromiseRouter {
          }
        }

+        const encodedUsername = encodeURIComponent(username);
+        const location = result.success
+          ? `${config.passwordResetSuccessURL}?username=${encodedUsername}`
+          : `${config.choosePasswordURL}?${params}`;
+
        return Promise.resolve({
          status: 302,
-          location: `${
-            result.success
-              ? `${config.passwordResetSuccessURL}?username=${username}`
-              : `${config.choosePasswordURL}?${params}`
-          }`,
+          location,
        });
      });
  }