Generated user passwords are translated incorrectly in the sent email.

[strike65]

Description:

When an admin generates a "random" password for a user, it may contain the "&" or any other "special html entity".
This is then rewritten as HTML entity by the parser that composes the email to the user: &

For example, the generated password would be: secureword&123
Then in the mail to the user appears: secureword&123

When the user then enters the password, it will of course not match.

This is a heavy bug I think.

Steps to reproduce:

1. Goto Administration -> Users
2. Select an user
3. Edit the user
4. Enable "Set random password and send by email"
5. Save

Expected behavior:

The password is sent without rewrite.

Actual behavior:

The password may contain html special entities.

Server Setup Information:

• Version of Rocket.Chat Server: 3.13.1
• Operating System: Linux
• Deployment Method: unknown
• Number of Running Instances: 1
• DB Replicaset Oplog: enabled
• NodeJS Version: 12.18.4
• MongoDB Version: 4.0.23 / mmapv1

Client Setup Information

• Browser or any desktop app
• Operating System: any

[bhavayAnand9]

I'd like to work on this issue :)

[strike65]

That would be nice!

[johncrisp]

Hi and thanks for reporting.
Can you please test this on the latest version as this may already be fixed.
Thanks.

[bhavayAnand9]

Hi @johncrisp
I tested this on Rocket.Chat Version: 3.15.0-develop, I was able to replicate this.
Thanks