   public function updateForgottenPassword(array $input) {
      $condition = [
         'glpi_users.is_active'  => 1,
         'glpi_users.is_deleted' => 0, [
            'OR' => [
               ['glpi_users.begin_date' => null],
               ['glpi_users.begin_date' => ['<', new QueryExpression('NOW()')]]
            ],
         ], [
            'OR'  => [
               ['glpi_users.end_date'   => null],
               ['glpi_users.end_date'   => ['>', new QueryExpression('NOW()')]]
            ]
         ]
      ];
      if ($this->getFromDBbyEmail($input['email'], $condition)) {
         if (($this->fields["authtype"] == Auth::DB_GLPI)
             || !Auth::useAuthExt()) {

            if (($input['password_forget_token'] == $this->fields['password_forget_token'])
                && (abs(strtotime($_SESSION["glpi_currenttime"])
                        -strtotime($this->fields['password_forget_token_date'])) < DAY_TIMESTAMP)) {

               $input['id'] = $this->fields['id'];
               Config::validatePassword($input["password"], false); // Throws exception if password is invalid
               if (!$this->update($input)) {
                  return false;
               }
               $input2 = [
                  'password_forget_token'      => '',
                  'password_forget_token_date' => null,
                  'id'                         => $this->fields['id']
               ];
               $this->update($input2);
               return true;

            } else {
               throw new ForgetPasswordException(__('Your password reset request has expired or is invalid. Please renew it.'));
            }

         } else {
            throw new ForgetPasswordException(__("The authentication method configuration doesn't allow you to change your password."));
         }

      } else {
         throw new ForgetPasswordException(__('Email address not found.'));
      }

      return false;
   }
The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.