Auto-generate password length on Password Reset page cannot be altered

[achbed]

We have a client that is requiring us to remove the auto-generated password from the password reset page. There is currently no way to do this, as the password is generated and placed without any filtering.

The attached patch adds a resetpass-gen-length filter to allow a plugin/theme to alter the password length, and if it is 0 or less, bypass the auto-generation entirely.

[peterwilsoncc]

Thanks for the patch.

Weak passwords are difficult to create by design in order to keep WordPress secure.

Additionally, this patch would allow plugins to alter the code to generate a weak password, triggering the difficult UI.

[SergeyBiryukov]

Related: #40046