        $confirm = pack('H*', gps('confirm'));
        $name    = substr($confirm, 5);
        $nonce   = safe_field("nonce", 'txp_users', "name = '".doSlash($name)."'");

        if ($nonce and $confirm === pack('H*', substr(md5($nonce), 0, 10)).$name) {
            include_once txpath.'/lib/txplib_admin.php';

            $message = reset_author_pass($name);
        }
    }
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.