Skip to content

1.8.11 doesn't wrap account registration e-mail address verification URIs in <a hrefs. #4269

@RokeJulianLockhart

Description

@RokeJulianLockhart

Current Behavior

When I registered at discuss.flarum.org/#:~:text=Load%20More-,Log%20In,-Log%20In%20with, I received:

Return-Path: <[email protected]>
X-Original-To: [email protected]
Delivered-To: [email protected]
Authentication-Results: mail.protonmail.ch; dkim=pass (Good 2048 bit
    rsa-sha256 signature) header.d=notifications.flarum.org
    header.a=rsa-sha256
Authentication-Results: mail.protonmail.ch; dmarc=pass (p=none dis=none)
 header.from=notifications.flarum.org
Authentication-Results: mail.protonmail.ch; spf=pass smtp.mailfrom=gw.d.sender-sib.com
Authentication-Results: mail.protonmail.ch; arc=none smtp.remote-ip=77.32.148.23
Authentication-Results: mail.protonmail.ch; dkim=pass (2048-bit key)
 header.d=notifications.flarum.org [email protected] header.b="fRowgnqg"
Received: from gw.d.sender-sib.com (gw.d.sender-sib.com [77.32.148.23]) (using TLSv1.3
 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
  key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No
 client certificate requested) by mailin036.protonmail.ch (Postfix) with ESMTPS id
 4d3lXb2zHTz9vNPq for <[email protected]>; Sat,
  8 Nov 2025 18:57:03 +0000 (UTC)
Received: by smtp-relay.sendinblue.com with ESMTP id
 95701e55-1a67-415a-b8ee-33032800b4cc; Sat, 08 November 2025 18:57:02 +0000 (UTC)
Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=notifications.flarum.org;
 q=dns/txt; s=brevo1; bh=KNRRHq83BuKCHmYAWe7zvi5EhQltHhOxPTEjz6RphcE=;
 h=from:subject:date:to:mime-version:content-type:content-transfer-encoding:list-unsubscribe:x-csa-complaints:list-unsubscribe-post:message-id:x-sib-id:feedback-id;
        b=fRowgnqgl0bsO2SipBAHqkBe5seCgbVQ5ES0j0dPZELmKXvrikOUOzgsniXeMPWWRG3iUJ5I1W3w
        8uSFYuBcl7vY5Y8yTmbYrL+3Tjc2QKxIr6IkWJYEaMTpioW+TTo+cLFCEPyqxqVd99n4SadErXjQ
        ZbqBXqZy8BsvXS2frXilOYq3EfycvgOe2QayaqvazrwUY+4nqCmZhfpuqJHNoKvwGznF9wIDj8w9
        Ei4RowL/3XCJxt8i1u9h5zLGf72PXwD+tjJZgS2FXdtsrbwHzevTaJp1n4DUG9uDZ8H8EsgBJFre
        0HxVdOcTa4tllwYZS4pyymuchLSL7Q8vobk2gA==
X-Mailin-Eid: Mjk5Nzg4MjQ2fnJva2VqdWxpYW5sb2NraGFydCtmbGFydW1AcG0ubWV%2BPDAxMjFkNGI5ODZlMDIzZWRiZmY3NzRjOWM4M2ZhYzA0QHN3aWZ0LmdlbmVyYXRlZD5%2BZ3cuZC5zZW5kZXItc2liLmNvbQ%3D%3D
Date: Sat, 08 Nov 2025 18:57:01 +0000
Subject: Activate Your New Account
Content-Type: multipart/mixed;boundary=---------------------025351431a30fc59bae561cc51149537
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0
Message-Id: <[email protected]>
Origin-Messageid: <[email protected]>
To: <[email protected]>
X-Sib-Id: XPKEvkBZwIw-m46D_F7x4ZUUmvS1dHWzsbJVXbBLFjlhDAIdmnajqD6CTgllrf9KVY6Zu25Aj3tBh5u7WtFrLbMR5_OagtOwh5VwusipmZBZvaNldQssYqJpOTt_SgKfu6Qb2uembDYUaK4JpMjlDNZMH3zfvA243WX7mTKe2LmRwH4mldTKTE6L-WeG
X-Csa-Complaints: [email protected]
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Feedback-Id: 77.32.148.23:8449469_-1:8449469:Sendinblue
From: "Flarum Community" <[email protected]>
List-Unsubscribe: <https://ieejegj.r.bh.d.sendibt3.com/tr/un/li/gWTn-6R2FKqpO2bpix3hILSbG1mH58bM-4yZWnX_UWNDu0_rPri1PXcfSoicAXK_b8hQGKCCF-EjY196gO_w5B3IW5LHvQLnDL5cTDZkTxS4uOaAuGqreFsy5YRa9yA4g80uknrEfP8G77hAaaJeJzrNf0h9V5BHb3u0kfKrtUE3fQ9M0h0rkzNV6BllIJNQmUKQcq8bU4pdjgmORlkub0W6cXrFNNmGJW4i_HSOkEXRPyjmdOVJbs7GpNS0QT2oHXMY1QZb_eg6x1OCWCH_UrfFJGlkrNFWwKNwhLgXeznH>
X-Pm-Spam: 0yezJI6YSpyJec91ztFGcjIwoJyLCvXBZcQniisnOkQZFNfRViDUMOslwsEjLnIjNJlb
 3wiAOLAjziMTMSXiwtJRETV9TSdUOiQURlOwsFdLjECJLSl0NBZ1XETElpbIjuTALM0VsLRkIUSf1F
 MVkfURSQUVitslOCMx4wiXSBEVSRVESSZ0X0Tf1lGRESkVRR5UUPR0XUTJFMiTlwlsOXwSiNRFSFTJ
 9FHTUPV9RTxkZ4AzXjIbp41MCiSwXSRFNN9FTVRTNdFQUbjpIM0FsUhkIUTfxlNTUOV9RT91IM1EV1
 XBRI6RyuzAWN0FsJ1kIUTfVRNSFPF9TTxkZbpjICMx4wiXSHVNTSRUfPJlRVTN9FfVEBEVSRVESbpj
 IFMs0JDIlfkRVS5UfQNVTUSFtg1X0bjpIMwCiuczNzMuIQ4MTzjILIxGplR3cCZpBB3bitC5bYlWsp
 B3c2auUV0bmsl0IIJlDfRkVUSf5NQTVFUtSXd1MbpjIFMs0JDIlfkRVS5UfMFkVUSJRlfVFClBUT9F
 CD9ET0SEVpbIjiCwMNczuuIzMTM4QIzLjpGxIcR3lpBCZibiB5zbCy29YZ5Szk5WZXZzJ9yY2jS5Zb
 02iiwSXkUWN9JRFWl9TQxUJUlERVWT9ZFQUM0JXTN0LiQURlOwsI3LCzy4NM4ixugDNjMgMlzbGkGV
 dIlGuhNHIXLyRN0dXuWQZY9mukVGZ2cuVVyZGym9LZJydTJCLEUfZVMSEQ19TQNVTbpjITLdBJTLCf
 EZUUFET6IyUyWw0wiXSSF9VR1UPfVEVUSB1UiR0wlsOX0XsjNnI3blJoxIjzCJLY92yiQWZjO9FJzL
 C6iIceJyhpR3Y2bi4JpOivmJbeICshNmIGdnVJ5b3ijoIVhEJfRkUEUSFlfVFHkVUSNVUUFkUUSO9w
 iIifWxbcN2viUmcnOisJPUF6CIRLIT1QJCLkUE9BSX1JURRQR1Ji40TjOsAJTIltjoIM4CyiwyN0Ui
 EEsOjkl9IZJW1p91ZmbvZp7IjSlBITQ0iisnOWah1VfZ2tmFbZIS6zhmIGdjF9ma1lW5aXR31kVmb3
 X1BIwXzwjUMNMjwiwiIWbpF8zbFfHJcb9WkiwWZiOtJlsYWy3BML0Sy1IDMDMxk5wMisCIdI1mhfxW
 a3MyBByX3i2IbOAjuzkTOTMwcc2OT4jMNNkz0tJCLWYslNhX2nGVdbJ35v12XGZsVoiIjpWFbbNGht
 0CdjMyAA5NTuTIMcQHitJCLWYslNhX2nGVdbJ35h52XWbiUJUOiSElSR9FQUJVQVWS9dJRUS1RUQRV
 Ji40TCLtJlsYWh2NXdVGn5J3b3XyBIib2ujAOOkTzwcTMTO2cM4Nj0zkNLJCwwN3XWYi0AuOj1DAMN
 Mz20UzMjMycEyOD1jANLJCwwN3XWYf1FzYm6SIZM4Cw3UDMzMzYQyNT4zINMIT2sUDMnIfBdpc3oGN
 dXR3voB3XXaoN5naWwjoILAjwycTMjMxQI1MT1jUMOIDzsQTMnI1J9ubllW1YIojisxWYWLlZR1YXz
 mVcLBX13N3XXajRJ9aCsX0fINnyiQWaiO2IBmOT4TIOMEWx5QWODNhFFmNmhWVOOADifX0=
X-Pm-Origin: external
X-Pm-Transfer-Encryption: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
X-Pm-Content-Encryption: on-delivery
X-Pm-Spamscore: 1
X-Pm-Spam-Action: inbox
X-Pm-List-Identifier: @[email protected]

-----------------------025351431a30fc59bae561cc51149537
Content-Type: multipart/related;boundary=---------------------5603c711c4293171d30c5f3cd4fc4fd6

-----------------------5603c711c4293171d30c5f3cd4fc4fd6
Content-Type: text/html;charset=utf-8
Content-Transfer-Encoding: base64

PGRpdj48aW1nIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHNyYz0iaHR0cHM6Ly9pZWVqZWdqLnIuYmgu
ZC5zZW5kaWJ0My5jb20vdHIvb3AvTVkwc1NaZnVldklzdkFZejJTWGkwdmF0OHJtZUxfVXI5UlFo
Qk1yTXlPbGN6NXlXNjA0YUZHYmUyNk54dGR3eEhfYmpWTnJYUlIxOXhhYzFSMXVfSmNRREw2X2N6
VHY5R2h6dExMY2hUTm1PRm9KTHFiOWRodFNRMGlMS01admJyUlpHLXptbDRIQzJGV21tdTBheHRk
WjZ4TFhUd1EzODdkRTZqYlc2c2ZXUkFEc2NPdTdoM2VUUklvSXhHcnVMMzZnVXUwQUFUenQzMk9K
N0VsUlQ4NGJwWUMyOHNFQnlCbjNnIiBzdHlsZT0ibXNvLWhpZGU6YWxsIi8+PC9kaXY+SGV5IFJv
a2VKdWxpYW5Mb2NraGFydCE8YnIvPjxici8+U29tZW9uZSAoaG9wZWZ1bGx5IHlvdSEpIGhhcyBz
aWduZWQgdXAgdG8gRmxhcnVtIENvbW11bml0eSB3aXRoIHRoaXMgZW1haWwgYWRkcmVzcy48YnIv
Pjxici8+SWYgdGhpcyB3YXMgeW91LCBzaW1wbHkgY2xpY2sgdGhlIGZvbGxvd2luZyBsaW5rIGFu
ZCB5b3VyIGFjY291bnQgd2lsbCBiZSBhY3RpdmF0ZWQ6PGJyLz5odHRwczovL2Rpc2N1c3MuZmxh
cnVtLm9yZy9jb25maXJtL3dWYkNUeUx4OXJpZUxKaU4zNnhMdW05NFVvMjYwSjVkTGJEVzdpWlY8
YnIvPjxici8+SWYgeW91IGRpZCBub3Qgc2lnbiB1cCwgcGxlYXNlIGlnbm9yZSB0aGlzIGVtYWls
Ljxici8+PGJyLz4K
-----------------------5603c711c4293171d30c5f3cd4fc4fd6--
-----------------------025351431a30fc59bae561cc51149537--

This renders as:

<div><img width="1" height="1" src="[https://ieejegj.r.bh.d.sendibt3.com/tr/op/MY0sSZfuevIsvAYz2SXi0vat8rmeL_Ur9RQhBMrMyOlcz5yW604aFGbe26NxtdwxH_bjVNrXRR19xac1R1u_JcQDL6_czTv9GhztLLchTNmOFoJLqb9dhtSQ0iLKMZvbrRZG-zml4HC2FWmmu0axtdZ6xLXTwQ387dE6jbW6sfWRADscOu7h3eTRIoIxGruL36gUu0AATzt32OJ7ElRT84bpYC28sEByBn3g](view-source:https://ieejegj.r.bh.d.sendibt3.com/tr/op/MY0sSZfuevIsvAYz2SXi0vat8rmeL_Ur9RQhBMrMyOlcz5yW604aFGbe26NxtdwxH_bjVNrXRR19xac1R1u_JcQDL6_czTv9GhztLLchTNmOFoJLqb9dhtSQ0iLKMZvbrRZG-zml4HC2FWmmu0axtdZ6xLXTwQ387dE6jbW6sfWRADscOu7h3eTRIoIxGruL36gUu0AATzt32OJ7ElRT84bpYC28sEByBn3g)" style="mso-hide:all"/></div>Hey RokeJulianLockhart!<br/><br/>Someone (hopefully you!) has signed up to Flarum Community with this email address.<br/><br/>If this was you, simply click the following link and your account will be activated:<br/>https://discuss.flarum.org/confirm/wVbCTyLx9rieLJiN36xLum94Uo260J5dLbDW7iZV<br/><br/>If you did not sign up, please ignore this email.<br/><br/>

Steps to Reproduce

  1. #!/usr/bin/env firefox
    window.location.href = 'https://discuss.flarum.org/#:~:text=Load%20More-,Log%20In,-Log%20In%20with'
  2. Select .item-logIn > button:nth-child(1) > span:nth-child(1).

  3. Select .LogInModal-signUp > a:nth-child(1).

  4. Fill the form:

    Image

  5. Visit the inbox for the supplied e-mail address.

Expected Behavior

Those aren't even <p>s. Some vaguely semantic HTML would be a pleasant improvement.

Environment

  • Flarum version

    /releases/latest returns 1.8.11.

  • Website URL

    discuss.flarum.org

  • Browser

    1. #!/usr/bin/env sh
      rpm -qi $(rpm -qf $(command -v firefox))
    2. Name         : firefox
      Version      : 144.0.2
      Release      : 1.fc43
      Architecture : x86_64
      Install Date : Tue 04 Nov 2025 19:17:44 GMT
      Size         : 265399208
      Signature    : RSA/SHA256, Mon 03 Nov 2025 12:07:19 GMT, Key ID 829b606631645531
      Source RPM   : firefox-144.0.2-1.fc43.src.rpm
      Build Date   : Mon 03 Nov 2025 07:30:13 GMT
      Build Host   : buildhw-x86-09.rdu3.fedoraproject.org
      Packager     : Fedora Project
      Vendor       : Fedora Project
      URL          : https://www.mozilla.org/firefox/
      Bug URL      : https://bugz.fedoraproject.org/firefox

Possible Solution

If this is generated from a <template>, improve its markup. If so, if you direct me to the file, I'll rewrite it. However, it doesn't appear to be:

Someone (hopefully you!) has signed up to {forum} with this email address.
If this was you, simply click the following link and your account will be activated:
{url}
If you did not sign up, please ignore this email.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions