Has anyone come across or put together a self-managed password reset solution that doesn't email the password?
The ResetPassword script in Login seems to create a new password, that doesn't get activated until a link is accessed, and both the new password and link are sent to the user.
I am looking for a way to just send a link to the user that would take them directly to the reset password screen so that the password does not get emailed.
This would need to be a verifiable (like with a hash url parameter) and time limited link.
Any ideas?
