From f645af4347a75772eff70fdc36616c2e4e15ca4d Mon Sep 17 00:00:00 2001
From: Yurii <yurikuzn@users.noreply.github.com>
Date: Thu, 15 Jan 2026 19:47:54 +0200
Subject: [PATCH] fix url rendering

---
 client/src/views/user/password-change-request.js | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/client/src/views/user/password-change-request.js b/client/src/views/user/password-change-request.js
index 1c444a3fa8..71b6dc0b83 100644
--- a/client/src/views/user/password-change-request.js
+++ b/client/src/views/user/password-change-request.js
@@ -139,12 +139,17 @@ export default class extends View {
 
                 const url = data.url || this.baseUrl;
 
-                const msg = this.translate('passwordChangedByRequest', 'messages', 'User') +
-                    ' <a href="' + url + '">' + this.translate('Login', 'labels', 'User') + '</a>.';
+                const a = document.createElement('a');
+                a.href = url;
+                a.innerText = this.translate('Login', 'labels', 'User');
+
+                const message = this.translate('passwordChangedByRequest', 'messages', 'User');
+
+                const html = this.getHelper().escapeString(message) + ' ' + a.outerHTML;
 
                 this.$el.find('.msg-box')
                     .removeClass('hidden')
-                    .html('<span class="text-success">' + msg + '</span>');
+                    .html('<span class="text-success">' + html + '</span>');
             })
             .catch(() => {
                 return $submit.removeClass('disabled');