    void requestResetPassword() throws Exception
    {
        when(this.userManager.exists(this.userReference)).thenReturn(true);
        InternetAddress email = new InternetAddress("foobar@xwiki.org");
        when(this.userProperties.getEmail()).thenReturn(email);
        BaseObject xObject = mock(BaseObject.class);
        when(this.userDocument
            .getXObject(DefaultResetPasswordManager.RESET_PASSWORD_REQUEST_CLASS_REFERENCE, true, this.context))
            .thenReturn(xObject);
        String verificationCode = "abcde1234";
        when(this.xWiki.generateRandomString(30)).thenReturn(verificationCode);
        when(this.localizationManager.getTranslationPlain("xe.admin.passwordReset.versionComment"))
            .thenReturn("Save verification code 42");

        ResetPasswordRequestResponse expectedResult =
            new DefaultResetPasswordRequestResponse(this.userReference, email,
                verificationCode);
        assertEquals(expectedResult, this.resetPasswordManager.requestResetPassword(this.userReference));
        verify(xObject).set(DefaultResetPasswordManager.VERIFICATION_PROPERTY, verificationCode, context);
        verify(this.xWiki).saveDocument(this.userDocument, "Save verification code 42", true, this.context);
    }
The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.