Fix the reset link in the activation emails

README.md

@@ -9,7 +9,7 @@ Lets administrators create user accounts from the ACP.
 - New **Add User** page under **ACP → Users and Groups**.
 - Set username, email, password (left blank, a random one is generated and never emailed), language and birthday.
 - Choose the user's group and optionally make it their default group; optionally add them to *Newly registered users*.
-- Follows the board's activation setting: the new user gets an email with a link to set their own password, or with admin activation you can activate the account on the spot.
+- Follows the board's activation setting: the new user gets an email with a link to set their own password, or with admin activation you can activate the account on the spot. With user activation, the email has the activation link instead, and the user sets their password with *Forgot password* after activating.
 - Every account created is recorded in the admin log.
 
 ## Requirements

acp/adduser_module.php

@@ -260,11 +260,16 @@ public function main($id, $mode)
 
 				// Send a message to the user if needed
 				$message = [];
+				$send_reset_link = true;
 
 				if ($this->config['require_activation'] == USER_ACTIVATION_SELF && $this->config['email_enable'])
 				{
 					$message[] = $this->user->lang['ACP_ACCOUNT_INACTIVE'];
 					$email_template = '@phpbbmodders_adduser/user_added_inactive';
+					// Activating the account clears reset_token (ucp_activate), and the reset
+					// form refuses inactive users, so a link could never be used here. The
+					// email tells the user to use "Forgot password" once activated instead.
+					$send_reset_link = false;
 				}
 				else if ($this->config['require_activation'] == USER_ACTIVATION_ADMIN && $this->config['email_enable'] && !$admin_activate)
 				{
@@ -295,34 +300,40 @@ public function main($id, $mode)
 					$messenger->headers('X-AntiAbuse: Username - ' . $this->user->data['username']);
 					$messenger->headers('X-AntiAbuse: User IP - ' . $this->user->ip);
 
-					// Send a reset link instead of the password: the user picks their own.
-					// route() ends in append_sid(), which would attach the session id of the
-					// admin creating the account. That must not travel by email.
-					$reset_expires = \phpbb\user::get_token_expiration();
-					$reset_token = strtolower(gen_rand_string(32));
-					$this->db->sql_query('UPDATE ' . USERS_TABLE . "
-						SET reset_token = '" . $this->db->sql_escape($reset_token) . "',
-							reset_token_expiration = " . (int) $reset_expires . '
-						WHERE user_id = ' . (int) $this->user_id);
-					global $_SID;
-					$sid_backup = $_SID;
-					$_SID = '';
-					$reset_link = generate_board_url(true) . $phpbb_container->get('controller.helper')->route(
-						'phpbb_ucp_reset_password_controller',
-						['u' => (int) $this->user_id, 'token' => $reset_token],
-						false
-					);
-					$_SID = $sid_backup;
-
 					$messenger->assign_vars([
 						'WELCOME_MSG'		=> htmlspecialchars_decode(sprintf($this->user->lang['WELCOME_SUBJECT'], $this->config['sitename'])),
 						'USERNAME'			=> htmlspecialchars_decode($data['username']),
-						'U_RESET_PASSWORD'	=> $reset_link,
-						'RESET_EXPIRES'		=> $this->user->format_date($reset_expires, str_replace('|', '', $this->user->lang['DATETIME_FORMAT'])),
 
 						'U_ACTIVATE'		=> "$server_url/ucp.$phpEx?mode=activate&u=$this->user_id&k=$this->user_actkey",
 					]);
 
+					if ($send_reset_link)
+					{
+						// Send a reset link instead of the password: the user picks their own.
+						// route() ends in append_sid(), which would attach the session id of the
+						// admin creating the account. That must not travel by email.
+						$reset_expires = \phpbb\user::get_token_expiration();
+						$reset_token = strtolower(gen_rand_string(32));
+						$this->db->sql_query('UPDATE ' . USERS_TABLE . "
+							SET reset_token = '" . $this->db->sql_escape($reset_token) . "',
+								reset_token_expiration = " . (int) $reset_expires . '
+							WHERE user_id = ' . (int) $this->user_id);
+						global $_SID;
+						$sid_backup = $_SID;
+						$_SID = '';
+						$reset_link = generate_board_url(true) . $phpbb_container->get('controller.helper')->route(
+							'phpbb_ucp_reset_password_controller',
+							['u' => (int) $this->user_id, 'token' => $reset_token],
+							false
+						);
+						$_SID = $sid_backup;
+
+						$messenger->assign_vars([
+							'U_RESET_PASSWORD'	=> $reset_link,
+							'RESET_EXPIRES'		=> $this->user->format_date($reset_expires, str_replace('|', '', $this->user->lang['DATETIME_FORMAT'])),
+						]);
+					}
+
 					$messenger->send(NOTIFY_EMAIL);
 				}
 

language/en/email/user_added_admin_welcome_inactive.txt

@@ -12,11 +12,11 @@ Board URL: {U_BOARD}
 
 Your account is currently inactive and will need to be approved by an administrator before you can log in. Another e-mail will be sent when this has occurred.
 
-Use this link to set your own password:
+Use this link to set your own password once an administrator has activated your account. Before that, it does not work:
 
 {U_RESET_PASSWORD}
 
-The link is valid until {RESET_EXPIRES}. After that, use “Forgot password” at {U_BOARD}.
+The link is valid until {RESET_EXPIRES}. If your account is activated after that, use “Forgot password” at {U_BOARD}.
 
 
 {EMAIL_SIG}

language/en/email/user_added_inactive.txt

@@ -14,11 +14,7 @@ Please visit the following link in order to activate your account:
 
 {U_ACTIVATE}
 
-Use this link to set your own password:
-
-{U_RESET_PASSWORD}
-
-The link is valid until {RESET_EXPIRES}. After that, use “Forgot password” at {U_BOARD}.
+After you have activated your account, set your own password with “Forgot password” at {U_BOARD}.
 
 
 {EMAIL_SIG}

language/en/info_acp_adduser.php

@@ -42,10 +42,10 @@
 	'ACP_ADD_USER'					=> 'Add User',
 	'DIR_NOT_EXIST'					=> 'The language you have chosen %s does not have the files needed for the extension. Please translate them and upload to the %s directory of the extension.',
 	'ACP_ACCOUNT_ADDED'				=> 'The user account has been created. A link was sent to the email address you provided; the user sets their own password with it. The email states how long the link is valid.',
-	'ACP_ACCOUNT_INACTIVE'			=> 'The user account has been created. However, the forum settings require the user to activate their account.<br>An activation key has been sent to the email address you provided for the user.',
+	'ACP_ACCOUNT_INACTIVE'			=> 'The user account has been created. However, the forum settings require the user to activate their account.<br>An activation key has been sent to the email address you provided for the user. After activating, the user sets their own password with “Forgot password”.',
 	'ACP_ACCOUNT_INACTIVE_ADMIN'	=> 'The user account has been created. However, the forum settings require account activation by an administrator.<br>An email has been sent to the Administrators and the user will be informed when their account has been activated',
 	'ACP_ADMIN_ACTIVATE'			=> 'An email will be dispatched to an Administrator for account activation. Alternatively you may check the activate account box below to activate the account instantly once created. The user will receive a link to set their own password.',
-	'ACP_EMAIL_ACTIVATE'			=> 'Once the account has been created, the user will receive an email containing an activation link to activate the account.',
+	'ACP_EMAIL_ACTIVATE'			=> 'Once the account has been created, the user will receive an email containing an activation link to activate the account. After activating, they set their own password with “Forgot password”.',
 	'ACP_INSTANT_ACTIVATE'			=> 'The account will be activated instantly. The user will receive a link to set their own password.',
 
 	'ADD_USER'					=> 'Add User',