The standard Joomla password reset process takes three steps:
- Enter email address and request reset token
- Complete the 'confirm' page with username and reset token (either by copying the token from the password reset email received into the already open browser tab, or by following the reset link in the email that pre-fills the token field but still requires the user to enter their username).
- Set and verify new password
I don't really see the point in requiring the user to enter their username when following the reset link provided to them via email - if they received the link, they have control of the email address associated with the user account. Asking them for their username is superfluous.
Granted, the link presently does not include the email address or username as a query parameter, but assuming it did so, step 2 could be bypassed altogether, making the process simpler. You might argue that requiring the user to also provide their username during the reset process increases overall security, but then if you are using the email address as the username as in my case, this is arbitrary and just annoying for users. The reset process could be done without exposing the username at all (by just including the email address as the additional query parameter), if this were of concern at any rate.
I've reviewed the Joomla code for the com_users module and unfortunately, without modifying Joomla code (which I strictly avoid) I can't see a way to manipulate the password reset link included in the reset email, via a plugin or otherwise, before it gets sent out. Can anybody think of a practical way to achieve this?