I've got sites running 4.9.2 and the "Forgot Password" link works as expected. However, sites running 5.0.0 and 5.0.1 produce an error (bad link).

The page cannot be displayed

Error Code: 500 Internal Server Error. The request was rejected by the HTTP filter. Contact your ISA Server administrator. (12217)

The URL in the addressbar is:

http://www.mydomain.com/Home/tabid/36/ctl/SendPassword/Default.aspx?returnurl=%2fHome%2ftabid%2f36%2fctl%2fLogin%2fDefault.aspx%3freturnurl%3d%252fDefault.aspx

If I manually alter the URL to:

http://www.mydomain.com/Home/tabid/36/ctl/SendPassword/Default.aspx?returnurl=%2fDefault.aspx

and hit Enter, it works.

Looking at the source of a 4.9.2 Login page, you see:

    <form name="form" method="post" action="/Home/tabid/36/ctl/Login/Default.aspx?returnurl=%2fDefault.aspx" id="form" enctype="multipart/form-data" style="height: 100%;" autocomplete="off">
 

Looking at the source of a 5.0.0 Login page, you see:

    <form name="form" method="post" action="/Home/tabid/36/ctl/Login/Default.aspx?returnurl=http%3a%2f%2fwww.mydomain.com%2fHome%2ftabid%2f36%2fDefault.aspx" onsubmit=" return Webform_OnSubmit();" id="form" enctype="multipart/form-data">
 

So clearly, there were some major changes in this area. The returnURL went from relative to full and appears to be the cause of the problem. Plus, an onsubmit event was added (may not be related).

The "Register" link is also broken. Works fine from the skin object, but not from the Login page.

Could anyone verify these two links not working on DNN5 please? Thanks.

Thanks for that.

I hear what you're saying and did realize that ISA is blocking it. However, it doesn't seem right that I have to modify my firewall for DNN to function properly, especially when it worked fine in DNN4. Furthermore, the link below works fine without any modifications to the firewall. So what's the difference.

This the URL from the Register skin object: (works fine):

http://www.mydomain.com/Home/tabid/36/ctl/Register/Default.aspx?returnurl=http%3a%2f%2fwww.mydomain.com%2fHome%2ftabid%2f36%2fDefault.aspx
 

This is the URL from the Register link on the Login page (error):

http://www.mydomain.com/Home/tabid/36/ctl/Register/Default.aspx?returnurl=http%253a%252f%252fwww.mydomain.com%252fHome%252ftabid%252f36%252fDefault.aspx

If you look at the encoded values of the returnurl, it's easy to see the differences. A forward slash (/) is %2f in the first link and %252f in the second. So DNN5 is using the wrong encoding for both the Login and Register links on the Login page.

The work items you listed were supposed to make things more consistent... I'd say they failed to do that.

Off to the Gemini site.

Related work item is located at DNN-9525.