verification code to reset password

NOTE: I apologize if this was asked/answered somewhere on forum - searched and couldn't find.

at default, when user requests password reset (option=com_comprofiler&view=lostpassword) CB is sending a new auto-system-generated password via email in plain text - I would rather set to option as Joomla does: to send a verification code TO allow user to RESET their password - how do I set this up/ configure it in CB?
Thanks!

We don't have such functionality. Our forgot login will always generate a new password and directly send it to them. We've a feature ticket already to basically rewrite how our forgot login behaviors to be more up to date with forgot logins usage standards in a later CB release.

Needless to say, I'm not at all a fan of passwords being sent around per email, either... it's almost like sending credit card details per postcard.

Since many good things seem to take a long time here I'm wondering if any of the password-related triggers in components/com_comprofiler/comprofiler.php could be utilized to make the new, emailed password valid for only a limited time. So, basically an Auto Action query which, a set time after it was emailed, deletes this new password again. `lastResetTime` and `lastvisitDate` in `#__users` could sure be helpful, hehe...

Thanks for any hints, Kyle.

Needless to say, I'm not at all a fan of passwords being sent around per email, either... it's almost like sending credit card details per postcard.

I agree, which is why we forced password to stop sending in pending/welcome emails unless you explicitly configure it to do so via password substitution except when using generated passwords. The forgot login is the last thing remaining where password is emailed that we've yet to improve as we need to rewrite the forgot login usage entirely.

I guess a custom plugin or somehow CB Auto Actions could make a new forgot login usage, but I've put no thought into such a usecase. You're welcome to try I suppose. You'd probably need 4 auto actions; 1 for the HTML form, 1 to process form data, 1 to handle password reset form, and 1 to process password reset form.

Since many good things seem to take a long time here I'm wondering if any of the password-related triggers in components/com_comprofiler/comprofiler.php could be utilized to make the new, emailed password valid for only a limited time. So, basically an Auto Action query which, a set time after it was emailed, deletes this new password again. `lastResetTime` and `lastvisitDate` in `#__users` could sure be helpful, hehe...

All the triggers available are listed in CB Auto Actions. There are some in regards to password reset. You could even hijack the entire forgot login page with CB Auto Actions to redirect a custom solution if you wanted as onLostPassForm is fired before the form is displayed and onStartNewPassword is fired before the form is processed.

Thanks Kyle,

I'll see if I can make something quick and easy. Don't mean to spend much time on it... because if I did, guaranteed you came with an reworked solution a few hours later, haha.

Oh BTW, what about the good old Joomla standard? Can I hijack your page and simply redirect to the native Joomla "Forgot password" page... perhaps after making that a menu item? Haven't tried that yet, I must admit...

Oh BTW, what about the good old Joomla standard? Can I hijack your page and simply redirect to the native Joomla "Forgot password" page... perhaps after making that a menu item? Haven't tried that yet, I must admit...

Only if you turn off CBs ability to redirect away from Joomla user component within the Community Builder system plugin in Extensions > Plugins. If you don't turn this off you won't be able to access Joomlas forgot login at all.