When building a mobile app, and using services3 and/or my custom module, I have a specific requirement:
I want anonymous users to be able to receive their password, in plaintext, in their email, if they give me their email address and if their account exists. If their account doesnt exist, I want to send a different email. I have trouble finding out where to start.
Services has user/request_new_password, and user/password_reset, but both seem to send out a one-time-link through email. Is there an easy way to modify those handlers ?
Otherwise, what would be a good appraoch in my own module ? Just create an entity_metadata_wrapper around the user, set the pass, call save and send the email ?
PS. Please dont start a discussion about that workflow, there is a reason for it. If you have additional advice for security without changing the workflow as described, I'm all ears.
