Index: wp-login.php
===================================================================
--- wp-login.php	(revision 15556)
+++ wp-login.php	(working copy)
@@ -115,6 +115,31 @@
 			echo '<p class="message">' . apply_filters('login_messages', $messages) . "</p>\n";
 	}
 } // End of login_header()
+
+/**
+ * Outputs the footer for the login page.
+ *
+ * @param string $input_id Which input to auto-focus
+ */
+function login_footer($input_id = '') {
+	echo "</div>\n";
+
+	if ( !empty($input_id) ) {
+?>
+<script type="text/javascript">
+try{document.getElementById('<?php echo $input_id; ?>').focus();}catch(e){}
+if(typeof wpOnload=='function')wpOnload();
+</script>
+<?php
+	}
+?>
+<p id="backtoblog"><a href="<?php bloginfo('url'); ?>/" title="<?php _e('Are you lost?') ?>"><?php printf(__('&larr; Back to %s'), get_bloginfo('title', 'display' )); ?></a></p>
+
+</body>
+</html>
+<?php
+}
+
 function wp_shake_js() {
 	global $is_iphone;
 	if ( $is_iphone )
@@ -211,14 +236,16 @@
 }
 
 /**
- * Handles resetting the user's password.
+ * Retrieves a user row based on password reset key and login
  *
  * @uses $wpdb WordPress Database object
  *
  * @param string $key Hash to validate sending user's password
- * @return bool|WP_Error
+ * @param string $login The user login
+ *
+ * @return object|WP_Error
  */
-function reset_password($key, $login) {
+function check_password_reset_key($key, $login) {
 	global $wpdb;
 
 	$key = preg_replace('/[^a-z0-9]/i', '', $key);
@@ -230,38 +257,26 @@
 		return new WP_Error('invalid_key', __('Invalid key'));
 
 	$user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_activation_key = %s AND user_login = %s", $key, $login));
+
 	if ( empty( $user ) )
 		return new WP_Error('invalid_key', __('Invalid key'));
+		
+	return $user;
+}
 
-	// Generate something random for a password...
-	$new_pass = wp_generate_password();
-
+/**
+ * Handles resetting the user's password.
+ *
+ * @uses $wpdb WordPress Database object
+ *
+ * @param string $key Hash to validate sending user's password
+ */
+function reset_password($user, $new_pass) {
 	do_action('password_reset', $user, $new_pass);
 
 	wp_set_password($new_pass, $user->ID);
-	update_user_option($user->ID, 'default_password_nag', true, true); //Set up the Password change nag.
-	$message  = sprintf(__('Username: %s'), $user->user_login) . "\r\n";
-	$message .= sprintf(__('Password: %s'), $new_pass) . "\r\n";
-	$message .= site_url('wp-login.php', 'login') . "\r\n";
 
-	if ( is_multisite() )
-		$blogname = $GLOBALS['current_site']->site_name;
-	else
-		// The blogname option is escaped with esc_html on the way into the database in sanitize_option
-		// we want to reverse this for the plain text arena of emails.
-		$blogname = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES);
-
-	$title = sprintf( __('[%s] Your new password'), $blogname );
-
-	$title = apply_filters('password_reset_title', $title);
-	$message = apply_filters('password_reset_message', $message, $new_pass);
-
-	if ( $message && !wp_mail($user->user_email, $title, $message) )
-  		wp_die( __('The e-mail could not be sent.') . "<br />\n" . __('Possible reason: your host may have disabled the mail() function...') );
-
 	wp_password_change_notification($user);
-
-	return true;
 }
 
 /**
@@ -398,39 +413,61 @@
 </form>
 
 <p id="nav">
+<a href="<?php echo site_url('wp-login.php', 'login') ?>"><?php _e('Log in') ?></a>
 <?php if (get_option('users_can_register')) : ?>
-<a href="<?php echo site_url('wp-login.php', 'login') ?>"><?php _e('Log in') ?></a> |
-<a href="<?php echo site_url('wp-login.php?action=register', 'login') ?>"><?php _e('Register') ?></a>
-<?php else : ?>
-<a href="<?php echo site_url('wp-login.php', 'login') ?>"><?php _e('Log in') ?></a>
+ | <a href="<?php echo site_url('wp-login.php?action=register', 'login') ?>"><?php _e('Register') ?></a>
 <?php endif; ?>
 </p>
 
-</div>
-
-<p id="backtoblog"><a href="<?php bloginfo('url'); ?>/" title="<?php _e('Are you lost?') ?>"><?php printf(__('&larr; Back to %s'), get_bloginfo('title', 'display' )); ?></a></p>
-
-<script type="text/javascript">
-try{document.getElementById('user_login').focus();}catch(e){}
-if(typeof wpOnload=='function')wpOnload();
-</script>
-</body>
-</html>
 <?php
+login_footer('user_login');
 break;
 
 case 'resetpass' :
 case 'rp' :
-	$errors = reset_password($_GET['key'], $_GET['login']);
+	$user = check_password_reset_key($_GET['key'], $_GET['login']);
 
-	if ( ! is_wp_error($errors) ) {
-		wp_redirect('wp-login.php?checkemail=newpass');
-		exit();
+	if ( is_wp_error($user) ) {
+		wp_redirect('wp-login.php?action=lostpassword&error=invalidkey');
+		exit;
 	}
 
-	wp_redirect('wp-login.php?action=lostpassword&error=invalidkey');
-	exit();
+	$errors = '';
 
+	if ( isset($_POST['pass1']) && $_POST['pass1'] != $_POST['pass2'] ) {
+		$errors = new WP_Error('password_reset_mismatch', __('The passwords do not match.'));
+	}
+	elseif ( isset($_POST['pass1']) && !empty($_POST['pass1']) ) {
+		reset_password($user, $_POST['pass']);
+		login_header(__('Password Reset'), '<p class="message reset-pass">' . __('Your password has been reset.') . ' <a href="' . site_url('wp-login.php', 'login') . '">' . __('Log in') . '</a></p>');
+		login_footer();
+		exit;
+	}
+
+	login_header(__('Reset Password'), '<p class="message reset-pass">' . __('Reset your password') . '</p>', $errors );
+?>
+<form name="resetpassform" id="resetpassform" action="<?php echo site_url('wp-login.php?action=resetpass&key=' . urlencode($_GET['key']) . '&login=' . urlencode($_GET['login']), 'login_post') ?>" method="post">
+	<p>
+		<label><?php _e('New Password') ?><br />
+		<input type="password" name="pass1" id="user_pass" size="16" value="" autocomplete="off" /></label>
+	</p>
+	<p>
+		<label><?php _e('New Password Again') ?><br />
+		<input type="password" name="pass2" id="user_pass" size="16" value="" autocomplete="off" /></label>
+	</p>
+	<br class="clear" />
+	<p class="submit"><input type="submit" name="wp-submit" id="wp-submit" class="button-primary" value="<?php esc_attr_e('Reset Password'); ?>" tabindex="100" /></p>
+</form>
+
+<p id="nav">
+<a href="<?php echo site_url('wp-login.php', 'login') ?>"><?php _e('Log in') ?></a>
+<?php if (get_option('users_can_register')) : ?>
+ | <a href="<?php echo site_url('wp-login.php?action=register', 'login') ?>"><?php _e('Register') ?></a>
+<?php endif; ?>
+</p>
+
+<?php
+login_footer('user_pass');
 break;
 
 case 'register' :
@@ -485,17 +522,8 @@
 <a href="<?php echo site_url('wp-login.php?action=lostpassword', 'login') ?>" title="<?php _e('Password Lost and Found') ?>"><?php _e('Lost your password?') ?></a>
 </p>
 
-</div>
-
-<p id="backtoblog"><a href="<?php bloginfo('url'); ?>/" title="<?php _e('Are you lost?') ?>"><?php printf(__('&larr; Back to %s'), get_bloginfo('title', 'display' )); ?></a></p>
-
-<script type="text/javascript">
-try{document.getElementById('user_login').focus();}catch(e){}
-if(typeof wpOnload=='function')wpOnload();
-</script>
-</body>
-</html>
 <?php
+login_footer('user_login');
 break;
 
 case 'login' :