39c57b82b853bb7aaa9ec15dc0b5f293b0329256 gperez2 Mon Aug 10 15:32:56 2026 -0700 Removing em dashes and dropping the "if you did not request this" line from hgLogin's login-link and change-email messages. refs #37929 diff --git src/hg/hgLogin/hgLogin.c src/hg/hgLogin/hgLogin.c index 2df0c4f7094..05e12e01b8c 100644 --- src/hg/hgLogin/hgLogin.c +++ src/hg/hgLogin/hgLogin.c @@ -1045,32 +1045,31 @@ { char expStr[32]; safef(expStr, sizeof(expStr), "%ld", clock1() + 3600); // link good for one hour char *sig = changeEmailSig(user, newEmail, expStr); char url[1024]; safef(url, sizeof(url), "%s?hgLogin.do.confirmChangeEmail=1&user=%s&newEmail=%s&exp=%s&sig=%s", hgLoginUrl, cgiEncode(user), cgiEncode(newEmail), expStr, sig); char subject[256]; safef(subject, sizeof(subject), "Confirm your new %s email address", brwName); char *remoteAddr = getenv("REMOTE_ADDR"); char message[4096]; safef(message, sizeof(message), "Someone (probably you, from IP address %s) asked to change the email address on the %s " "account \"%s\" to this address.\nTo confirm the change, open this link in your browser:\n\n" - "%s\n\nThe link works once and expires in one hour. If you did not request this, you can " - "safely ignore this email and your address will stay as it is.\n\n%s\n%s", + "%s\n\nThe link works once and expires in one hour.\n\n%s\n%s", emptyForNull(remoteAddr), brwName, user, url, signature, returnAddr); sendActMailOut(newEmail, subject, message); freeMem(sig); } static void sendChangeEmailAlertMail(char *oldEmail, char *user, char *newEmail) /* Tell the OLD address that the account's email was just changed, so its owner finds out if the * change was not theirs and can ask us to undo it. This is the notice that protects the current * owner -- confirming the new address only proves the new mailbox is reachable. */ { char subject[256]; safef(subject, sizeof(subject), "Your %s email address was changed", brwName); char *remoteAddr = getenv("REMOTE_ADDR"); char message[4096]; safef(message, sizeof(message), @@ -1185,31 +1184,31 @@ errMsg = cloneString("Please enter your current password."); changeEmailPage(conn); return; } } /* Do not change the address yet: email a one-time confirmation link to the NEW address and * apply the change only when it is clicked (see confirmChangeEmail). This proves the address * is real and controlled by the requester, so an unconfirmed address cannot silently become * the account's recovery address. */ sendChangeEmailConfirmMail(email1, user); cartRemove(cart, "hgLogin_newEmail1"); cartRemove(cart, "hgLogin_newEmail2"); cartRemove(cart, "hgLogin_curPassword"); char *encEmail = htmlEncode(email1); hPrintf("<div class=\"centeredContainer formBox\"><h2>%s</h2>", brwName); -hPrintf("<h3>Almost done — please check your email</h3>"); +hPrintf("<h3>Almost done. Please check your email</h3>"); hPrintf("<p>We sent a confirmation link to <b>%s</b>. Open the link in that message to finish " "changing your email address. The link works once and expires in one hour.</p></div>", encEmail); freeMem(encEmail); returnToURL(3000); } void confirmChangeEmail(struct sqlConnection *conn) /* Apply a confirmed email change. Reached by opening the signed link sent to the new address * (see sendChangeEmailConfirmMail); the signature and its expiry are the authorization, so this * does not require a login cookie -- the link may be opened from the new mailbox in any browser. */ { if (!emailLinkEnabled()) { displayLoginPage(conn); @@ -2361,56 +2360,55 @@ "<input type=\"submit\" name=\"hgLogin.do.sendEmailLink\" value=\"Send login link\" class=\"largeButton\">" " <a href=\"%s\" class=\"cancelButton\">Cancel</a>" "</div></form></div><!-- END - emailLinkBox -->", getReturnToURL()); cartSaveSession(cart); } void displayLoginLinkSuccess() /* Confirmation shown after a passwordless login link is (possibly) emailed. Phrased so it * does not reveal whether an account exists for the address. */ { char *email = htmlEncode(cartUsualString(cart, "hgLogin_sendMailTo", "")); hPrintf("<div id=\"confirmationBox\" class=\"centeredContainer formBox\">" "<h2>%s</h2>", brwName); hPrintf("<p id=\"confirmationMsg\" class=\"confirmationTxt\">If an account exists for " "<B>%s</B>, a login link has been sent to that address.<BR><BR>" - "Click the link in that email to sign in — no password needed. " + "Click the link in that email to sign in. No password needed. " "The link works once and expires in one hour.</p>", email); hPrintf("<p>If you don't see the email, please check your spam folder.</p>"); hPrintf("<p><a href=\"%s?hgLogin.do.displayLoginPage=1\">Return to Login</a></p>\n", hgLoginUrl); cartRemove(cart, "hgLogin_email"); cartRemove(cart, "hgLogin_sendMailTo"); cartRemove(cart, "hgLogin_helpWith"); } void sendLoginLinkMail(char *email, char *token) /* Email a one-time passwordless login link to an address. The link identifies the address, * not a single account: if the address has several accounts, the user picks one after * clicking (see emailLogin), so one email covers them all. */ { char subject[256]; char msg[4096]; char url[512]; char *remoteAddr = getenv("REMOTE_ADDR"); safef(url, sizeof(url), "%s?hgLogin.do.emailLogin=1&email=%s&token=%s", hgLoginUrl, cgiEncode(email), cgiEncode(token)); safef(subject, sizeof(subject), "Your login link for the %s", brwName); safef(msg, sizeof(msg), "Someone (probably you, from IP address %s) requested a login link for the %s account " "registered to this email address.\nClick the link below to sign in without a password. " - "It works once and expires in one hour:\n\n%s\n\nIf you did not request this, you can " - "safely ignore this email.\n\n%s\n%s", + "It works once and expires in one hour:\n\n%s\n\n%s\n%s", remoteAddr, brwName, url, signature, returnAddr); sendActMailOut(email, subject, msg); } void sendEmailLink(struct sqlConnection *conn) /* Generate and email a one-time passwordless login link to the address on file. */ { if (!emailLinkEnabled()) { displayLoginPage(conn); return; } char *email = cartUsualString(cart, "hgLogin_email", ""); if (isEmpty(email) || spc_email_isvalid(email) == 0) {