Password Reset question

[DavidF]

Hi,

 

 

I was wondering if you could advise me. we are currently designing the password reset system, we would like to avoid sending clear text passwords over the internet.

*

 

We have a html asking for the email, then secret question and answer. From what I can see, if the user enters the correct information we could call login.php and an email is sent to the user with a token in it. That token is of course mydomain.com with /pwrest.php?...and a token code.

 

 

If the user clicks on the link we would like that to go to a secure html page where the user will type in their new password, confirm it, then be taken to our home page as a login user.

 

 

From what I can see of the email template you use the $pw_reset_url variable in the email template and that will point us towards pwrest.php

 

 

Is there a way not to change it to a password reset HTML page?

 

And can I configure the life of the token code email,may 24 hours

 

 

Thanks

 

 

David