<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 07/19/2015 03:35 PM, Andrew Shadura
wrote:<br>
</div>
<blockquote
cite="mid:98cb64feddfb89f106f6.1437312955@localhost.localdomain"
type="cite">
<pre wrap=""># HG changeset patch
# User Andrew Shadura <a class="moz-txt-link-rfc2396E" href="mailto:andrew@shadura.me"><andrew@shadura.me></a>
# Date 1431821238 -7200
# Sun May 17 02:07:18 2015 +0200
# Node ID 98cb64feddfb89f106f66763462061fd2ca3f412
# Parent f103b1a2383bc4fba5d28f9732ba832025e3bf00
secure password reset implementation</pre>
</blockquote>
<br>
A couple of other things:<br>
<br>
It should make sure it doesn't go too far with changing passwords
when using external authentication (but also not reveal too much
information too early). (I guess it would be nice if each
authentication module had a customizable "tell the user how to
change the password" string...)<br>
<br>
The user is redirected to a "
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
Code you received in the email" page ... but the mail only contains
a URL - no mentioning of any code.<br>
<br>
/Mads<br>
</body>
</html>