Conversation
…for a user
Adds an admin-only OCS endpoint POST /ocs/v2.php/cloud/users/{userId}/resetpassword that reuses the existing lost-password flow (IVerificationToken + core.ResetPassword mail template), respecting the same lost_password_link config and per-user rate limit as the self-service path. Mirrors resendWelcomeMessage's admin/subadmin scoping exactly.
Frontend: new 'Send password reset email' action in the settings user-row menu (only shown when the account has an email), backed by a new sendPasswordResetMail Vuex store action.
openapi.json + openapi-full.json hand-updated to include the new endpoint; CI regen may normalize formatting on next run.
Closes nextcloud#14411
Signed-off-by: Tim <tmmmemcee@gmail.com>
tmmmemcee
requested review from
kristian-zendato,
leftybournes,
salmart-dev,
skjnldsv and
sorbaugh
and removed request for
a team
September 25, 2026 23:59
skjnldsv
requested changes
Sep 26, 2026
skjnldsv
left a comment
skjnldsv
left a comment
Member
There was a problem hiding this comment.
Please have a look at our ai policy and its requirements when opening pull requests
Thanks 😊
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #14411
Summary
Adds an admin-only OCS endpoint that triggers the existing lost-password email flow for a user, so admins can force a password reset without knowing the current password. Mirrors the existing
resendWelcomeMessageendpoint's admin/subadmin scoping pattern and reuses the real lost-password machinery (IVerificationToken+ thecore.ResetPasswordmail template) — not a reinvented copy.Backend
POST /ocs/v2.php/cloud/users/{userId}/resetpasswordLostController::sendEmail):lost_password_link !== 'disabled'(returns 400)lostpasswordemail5 / 30 min (same as self-service; returns 429)#[PasswordConfirmationRequired]and#[NoAdminRequired]— admin/subadmin scoping identical toresendWelcomeMessagecore.ResetPasswordemail with a freshly-issued token via the same flow as the self-service lost-password form, so the email looks identical to the userFrontend
UserRow.vue), shown only when the account has an email, cloned from the "Resend welcome email" patternsendPasswordResetMailinapps/settings/src/store/users.jsposting to the new endpointopenapi.json
openapi.jsonandopenapi-full.jsonhand-updated to include the new endpoint (cloned from thewelcomeentry). CI regen on the next push may normalize formatting — happy to follow up if it produces a cleaner diff.Test plan / verification
php -lclean onUsersController.php+routes.phpnode --checkclean on the new store actioncomposer install/npm ciare multi-GB)Credits / prior art
Implementation follows the maintainer scope laid out by @skjnldsv in the original issue (2019): an OCS provisioning API option + a Vue action in the user management UI.