Bypass password reset 'confirm' page

Question

The standard Joomla password reset process takes three steps:

1. Enter email address and request reset token
2. Complete the 'confirm' page with username and reset token (either by copying the token from the password reset email received into the already open browser tab, or by following the reset link in the email that pre-fills the token field but still requires the user to enter their username).
3. Set and verify new password

I don't really see the point in requiring the user to enter their username when following the reset link provided to them via email - if they received the link, they have control of the email address associated with the user account. Asking them for their username is superfluous.

Granted, the link presently does not include the email address or username as a query parameter, but assuming it did so, step 2 could be bypassed altogether, making the process simpler. You might argue that requiring the user to also provide their username during the reset process increases overall security, but then if you are using the email address as the username as in my case, this is arbitrary and just annoying for users. The reset process could be done without exposing the username at all (by just including the email address as the additional query parameter), if this were of concern at any rate.

I've reviewed the Joomla code for the com_users module and unfortunately, without modifying Joomla code (which I strictly avoid) I can't see a way to manipulate the password reset link included in the reset email, via a plugin or otherwise, before it gets sent out. Can anybody think of a practical way to achieve this?

Answer 1

Just came across this extension, which would allow me to create an override of the com_users registration controller class (in order to add the extra query parameter to the reset link), as an alternative to the other proposed solution:

https://gruz.ml/en/extensions/mvcoverride.html

Experienced developers only, mind. Might be useful to somebody coming this way.

Answer 2

If you only need to modify the com_users module, surely you can just make an override by copy-pasting it into your template, e.g. into: template/html/com_users/registration/default.php?

Then you would like to set username field hidden and set the value to it, which you can load from the database by the query with the reset link unique part.

(Alternatively this for Joomla 1 might contain some clues, if you're a developer: https://forum.joomla.org/viewtopic.php?t=50531)