WISE-Community/WISE-Portal — Issue #28: Change teacher password improvement
Author: hirokiterashima
Created: 2012-02-13 18:11:00+00:00
State: open

Right now this is how change teacher password works:
1. You type in teacher username
2. WISE resets that user's password and sends the new password to the user's email
3. User gets new password in the email

or
1. You type in email address
2. WISE finds first user with that email address, changes its password and sends the new password to the user's email
3. User gets new password in the email.

The problem here is that anyone can type anybody else's username or email address and have the password changed.

This is how it should work:
1. You type in teacher username or email address
2. WISE sends email to the user with a link to change the password (valid for X min)
3. User gets email, can click on it to go to a change password page, or ignore it