benedmunds/CodeIgniter-Ion-Auth — pull request #194 by michaelbrooks (2012-04-23 09:49:48+00:00)
Title: reset_password should not send users a plain text password by email

Because the majority of users will not go to the trouble to change the randomly assigned password.

I changed the reset_password method on auth controller. It verifies the reset code using a new model function (forgotten_password_check), then shows a password reset form, which rechecks the reset code, the claimed user id, and a csrf field, before changing the password. If there are mismatches, it clears the forgot password code from the database.

With this change, the user only receives one email with a password reset link in it, and chooses the new password right away. I see you commented on this topic a couple of years ago here: http://codeigniter.com/forums/viewthread/154332/ but I wonder if the two-step process is still preferable. I can't recall ever seeing that type of process elsewhere.