375902 - password reset clean up

Status: RESOLVED FIXED

(Mozilla Labs :: Joey, defect)

Description

[Doug Turner (:dougt)]

reset password should work like this: When you click on the reset link, an re-activate email is send to you but the old password still works. The system asks you to change password when you clicks on the link in the email ...

Comment 1

[Michael Yuan]

From Wil, how AMO did it:

"If they reset, we send them a URL with a key of  md5(the_md5_hash_of_their_old_password) and confirmation code stays null. So, they can still login, but if they go to the url with the special key, we provide a form where they can enter a new password"

Comment 2

[Michael Yuan]

Done. I also put in a new validation requirement for the username: it must be [a-zA-Z_0-9] because I need to put it in the un-encoded form in the password reset URL.