Thanks a lot for your posting about building a form on its own to change user password. I used your suggested approach and I coud implement easily many isolated forms to let people change password, avatar, and so on.
What I cannot solve is how to use the same logic to reset forgotten password on a form on its own called from the one-time login link.
I tried this: - I installed module Login Destinations and added the following destination rule triggered on one-time login link:
global $user;
// Let the user's password be changed without the current password check.
$token = drupal_hash_base64(drupal_random_bytes(55));
$_SESSION['pass_reset_' . $user->uid] = $token;
return array('change-password', array('query' => array('pass-reset-token' => $token)));
It is triggered from user/reset/*.
change-password is my custom form implemented like this.
function _tb_user_render_user_pass_set_new_form() { global $user; if (!user_is_logged_in()) { drupal_access_denied(); } module_load_include('inc', 'user', 'user.pages'); $form = drupal_get_form('user_profile_form', $user); $children = element_children($form); foreach ($children as $child) { if (!($child == 'account' || $child == 'actions' || $child == 'form_build_id' || $child == 'form_token' || $child == 'form_id' || $child == 'current_id' || $child == 'revision_id' || $child == 'current_date')) { unset($form[$child]); } } $children = element_children($form['account']); foreach ($children as $child) { if (!($child == 'current_pass_required_values' || $child == 'pass')) { unset($form['account'][$child]); } } return $form; }
It does't work since it still requires current password.
Do you have any idea on how to do that properly?