Secure "forgotten password" function

[kossmoss]

I think, changing forgotten password to 'password' for everyone is not secure.

I use such a code in my login.php:

				if($DBconf == $confirmationcode && !empty($confirmationcode)){
					$new_pass = substr(md5(uniqid(rand(), true)), 0, 8);
					$passhash = generateHash($new_pass);
					$db->query('UPDATE `' . table_users . '` SET `last_reset_code` = "" WHERE `user_login` = "'.$username.'"');
					$db->query('UPDATE `' . table_users . '` SET `user_pass` = "'.$passhash.'" WHERE `user_login` = "'.$username.'"');
					$errorMsg = "Your password has been reset to '$new_pass'. ".$main_smarty->get_config_vars('PLIGG_Visual_Login_Forgot_PassReset');
				}

Of course, 'PLIGG_Visual_Login_Forgot_PassReset' value must be changed in your lang file to 'Please login and change your password'

[Yankidank]

SVN version changed it so that the password is reset to a random value and emailed to the user.

[kossmoss]

Oh, that's very good!