Magento Stack Exchange is a question and answer site for users of the Magento e-Commerce platform. It only takes a minute to sign up.
Sign up to join this community
If a user forgets her password, she can request a new one which will be sent as plain text by mail. Is there a way (extension for example) to not send the password directly, but a password recovery link which is only valid for a certain amount of time?
Thanks!
You have a ton of bugs and security issues with your version. There is "no alternative" to upgrade! This said, check out the code of Magento 1.9 for the sendPasswordForgottenEmail.
It starts here:
\Mage_Customer_AccountController::forgotPasswordPostAction
generates a password reset token:
$newResetPasswordLinkToken = Mage::helper('customer')->generateResetPasswordLinkToken();
$customer->changeResetPasswordLinkToken($newResetPasswordLinkToken);
$customer->sendPasswordResetConfirmationEmail();
sends an email with this token app/locale/en_US/template/email/account_password_reset_confirmation.html
If you click on it, the token is checked \Mage_Customer_AccountController::resetPasswordAction, then you can reset your password: app/code/core/Mage/Customer/controllers/AccountController.php:591
