require password change upon login with auto-generated password sent via unsecure e-mail

[Phil Mocek <pmocek-trac-hacks@…>]

If a password is reset and sent though e-mail (these messages are currently sent in-the-clear) a user should be required to change his password immediately after logging in with the new, temporary password that was sent to him.

[rupert thurner]

see also #843 for email validation, captcha, ..

[Pedro Algarvio, aka, s0undt3ch]

I've implemented this for trac 0.11, ie, the trunk version of this plugin.

You can download a patch from ​here and the admin config panel changes from ​here.

Basically if the option to force the users to change passwords after a password reset is enabled, the user will always be sent to /prefs/account after login to change his password with a nice warning message.

[John Hampton]

(In [3731]) Added forcing password change after reset. Patch by s0undt3ch. Minor change such that the message indicating password reset needed isn't shown after a successful password reset. Fixes #1427

[John Hampton]

FYI, this is a 0.11 only feature. Also, it is on by default and can be turned off in the account manager admin page.

[Steffen Hoffmann]

Because of #816 this feature has been rewritten lately.