Hi. I am using the User Service and am implementing a password reset feature in case my users forget their passwords. However, the way it is now, any user can enter the email of another user to have that users password reset. A message is sent to the email with the new password.
What I need is that when a user requests to have their password reset, an email is sent to them saying that it was requested to have their password reset. If they click the link provided, the password would be reset and another email sent to them with the new password. Otherwise they can just ignore the email and their password would not be changed. This way, the user has to actually have access to the email account to reset the password.