Before the patch Login as admin. Navigate to Site administration / Plugins / Authentication / Manage authentication Set the " Forgotten password URL " setttig to a non-http/https URL. For example: mailto:someone@example.com Save the changes After the patch Master only Purge caches Navigate to admin/index.php . Confirm that you see a warning indicating that the forgotten password URL is invalid. Click on the Check button Confirm that you are redirected to the " Manage authentication " admin page. With the " Forgotten password URL " setttig still set to an invalid URL, click " Save changes ". Confirm that you get a validation error indicating that the forgotten password URL is invalid. Now, enter a valid http/https URL for the forgotten password URL. (Or just set it to empty) Click " Save changes " Confirm that the changes are successfully saved. Navigate to admin/index.php . Confirm that you don't see the warning about the invalid forgotten password URL. Master, 33 and 32 As admin, enable "Mobile services": Site administration ► Mobile app ► Mobile settings Navigate to Site administration / Plugins / Authentication / Manage authentication Set the " Forgotten password URL " setttig to a non-http/https URL. For example: mailto:someone@example.com Note: On master, you'll have to manually update the mdl_config table in the database directly to go over the form validation: UPDATE mdl_config SET value = 'mailto:someone@example.com' WHERE name = 'forgottenpasswordurl' Try to access to the site using the mobile app Confirm that you can still log-in even if the " forgottenpasswordurl " setting is not correct