Generate new password on recovery request

I would like this feature too.

I used this module to regenerate new password on Request new password by altering the submit function to send a new password and save it to user account. My code as follow:

/**
 * Implements hook_form_form_alter().
 *
 * Overwrite the submit function of the request new password form.
 */
function MODULE_NAME_form_user_pass_alter(&$form, &$form_state, $form_id) {
  $form['#submit'][0] = 'MODULE_NAME_user_pass_submit';  
}

/**
 * Overrides the submit function user_pass_submit().
 *
 * @see MODULE_NAME_form_user_pass_alter()
 */
function MODULE_NAME_user_pass_submit($form, &$form_state) {
  global $language;
  
  $account = $form_state['values']['account'];
  
  // Generate new password
  $password = user_password();
  
  // Save new password
  user_save($account, array('pass' => $password));
  
  // Add plain text password into user account to generate mail tokens.
  $account->password = $password;
  
  // Mail one time login URL and instructions using current language.
  $mail = _user_mail_notify('password_reset', $account, $language);
  if (!empty($mail)) {
    watchdog('user', 'Password reset instructions mailed to %name at %email.', array('%name' => $account->name, '%email' => $account->mail));
    drupal_set_message(t('Further instructions have been sent to your e-mail address.'));
  }
  
  $form_state['redirect'] = 'user';
  return;
}

I'm the maintainer for User Registration Password ( http://drupal.org/project/user_registrationpassword ) and i'm working on the exact same issue. (code)

I believe the rpt module should stay as clean as possible, i'm not even sure if we should add it to the user_registrationpassword module, maybe this could be a separate module, so more modules can use it's functionality.

For now the functionality is almost implemented in user_registrationpassword, i'll push a new release in a couple days.

The only thing that needs to change in rpt is adding an else{} in rpt_tokens() looking something like this:

elseif (isset($data['user']) && !isset($data['user']->password)) {
    $replacements['[user:password]'] = t('Your password');
  }

This would prevent the whole situation. The user already has a password set, so we can safely assume the user already got this in a previous email. If not, they can request a new password.

For user_registrationpassword this would work very nice, because it's also core behaviour to return 'Your password' - and it should not break anything + works great with our new features + rpt integration.

Thanks all, commited/pushed to 7.x-1.x.