I don’t feel very mighty today, but the Login package contains a "ChangePassword" snippet. You might be able to redirect the user from the landing page for forgot password to a page with that snippet on it (or provide a link to that page). If not, it would be a good feature request because leaving the user with a password that has been sent via email is probably not a good idea.
<p>Your temporary password is insecure, please change it <a href="[[~##]]"> here</a>.</p>
<?php $modx->sendRedirect($modx->makeUrl(##) );
[[!ChangePassword? &reloadOnSuccess=`0` &successMessage=`[[!%login.change_password? &namespace=`login` &topic=`changepassword`]] - [[!%login.profile_updated? &namespace=`login` &topic=`updateprofile`]]`]]
<div class="change-password">
<div style="color:#66CC00">[[+logcp.successMessage]] </div>
<br />
<form class="form" action="[[~[[*id]]]]" method="post">
<input type="hidden" name="nospam:blank" value="" />
<label for="password_old">[[!%login.password_old? &namespace=`login` &topic=`changepassword`]]:
<span class="error">[[+logcp.error.password_old]]</span>
</label>
<input type="password" name="password_old" id="password_old" value="[[+logcp.password_old]]" />
<br />
<label for="password_new">[[!%login.password_new? &namespace=`login` &topic=`changepassword`]]:
<span class="error">[[+logcp.error.password_new]]</span>
</label>
<input type="password" name="password_new" id="password_new" value="[[+logcp.password_new]]" />
<br />
<label for="password_new_confirm">[[!%login.password_new_confirm? &namespace=`login` &topic=`changepassword`]]:
<span class="error">[[+logcp.error.password_new_confirm]]</span>
</label>
<input type="password" name="password_new_confirm" id="password_new_confirm" value="[[+logcp.password_new_confirm]]" />
<br />
<br class="clear" />
<div class="form-buttons">
<input type="submit" name="logcp-submit" value="[[!%login.change_password]]" />
</div>
</form>
</div>
Can’t you just put something like this on the landing page?
<p>Your temporary password is insecure, please change it <a href="[[~##]]"> here</a>.</p>
where ## is the ID of the page with the change password snippet and the change password form?
Or, you could put a snippet on the landing page that just forwards them to the change password page.
<?php $modx->sendRedirect($modx->makeUrl(##) );
where ## is, again, the ID of the change password page (which would contain the message about the temp. password being insecure).
Sorry, the only thing that comes to mind is EI conditional comments in the template, but that’s pretty unlikely to cause your problem.
I’m guessing, but I think to use the success message, you just take out the redirect property, set the success message property and redirect the form to the current page. (action="[[~id]]"). You need to include a placeholder for the success message on that page.