function change_pass()
{
    global $txp_user;

    extract(psa(array('new_pass', 'mail_password')));

    if (empty($new_pass)) {
        author_list(array(gTxt('password_required'), E_ERROR));

        return;
    }

    $rs = change_user_password($txp_user, $new_pass);

    if ($rs) {
        $message = gTxt('password_changed');

        if ($mail_password) {
            $email = fetch('email', 'txp_users', 'name', $txp_user);

            send_new_password($new_pass, $email, $txp_user);

            $message .= sp.gTxt('and_mailed_to').sp.$email;
        }

        $message .= '.';

        author_list($message);
    }
}
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.