Alter user_pass_reset for one time login D7 I don't like the one time login process; sending the users directly to their user edit page is not what I want. I want to force the users to insert a new password.

I have created a module that doesn't work; obviously I'm not affecting the submit action and is not taking the newly inserted username to the user object. 

// Let's try to add a form in the user pass reset form for password requests.
function xxx_login_form_alter(&amp;$form, &amp;$form_state, $form_id) {
  if ($form_id == 'user_pass_reset') {
    $form['#account'] = $GLOBALS['user'];
    $form['loginsetup'] = array(
      '#title' =&gt; t('Login setup'),
      '#type' =&gt; 'fieldset',
      '#collapsible' =&gt; FALSE,
      '#collapsed' =&gt; FALSE
    );
    $form['loginsetup']['account']['name'] = array(
      '#type' =&gt; 'textfield',
      '#size' =&gt; 25,
      '#title' =&gt; t('Username'),
      '#required' =&gt; TRUE
    );  

    $form['loginsetup']['account']['pass'] = array(
      '#type' =&gt; 'password_confirm',
      '#size' =&gt; 25,
      '#title' =&gt; 'Please enter your new password',
      '#required' =&gt; TRUE,
    );

    $form['message']['#markup'] = FALSE;
    $form['help']['#markup'] = FALSE;
    $form['actions']['submit']['#value'] = 'Enter';
    //  $form['#validate'][] = 'xxx_login_user_pass_validate';
    $form['#submit'][] = 'xxx_login_user_pass_submit';
  }

  return $form;
}

// We'll check if the user did not leave a username.

// function xxx_login_user_pass_validate($form, &amp;$form_state) {
//   if (empty($form_state['values']['name'])) {
//     form_set_error('name', t('You must select a username.'));
//   }
// }

// We should send the new values to the user object.

 function xxx_login_user_pass_submit($form, &amp;$form_state) {
   // Set up the edit array to pass to user_save().
   $edit = array(
     'pass' =&gt; $form_state['values']['pass'],
     'name' =&gt; $form_state['values']['name']
   );

   // Save the account with the new password and name
   user_save($form['#account'], $edit);

   // Inform the user.
   drupal_set_message(t('Your login details have been stored. Welcome to example.com!'));
}


The validate function is now commented, but it does not affect the module; with or without it, it still does not work.
This is a bit of a SNAFU as user_password_reset doesn't have a hook associated with it. Why that is, I fail to see.

However, you can always use this little trick in hook_user_login to determine when users log in with a reset link by checking the emptiness of the $edit parameter as the only time it will be empty will be when the user didn't submit a form to log in = when they were automatically logged in.

function mymodule_user_login(&amp;$edit, $account){
  if(!$edit){ // only for automatic pwd resets
    // do your thing, redirect to a password change form with drupal_goto or whatever you need.
  }
}


The implementation of forcing the user set a new password is another question altogether. We do it with a modal window that shows a simple custom form, but there are plenty of ways to do it. Unfortunately the easiest one is sending the user to their user edit form like the password reset functionality automatically does, but there's absolutely no reason why you couldn't just do whatever at that point as the user is logged in and good to go.