    public function save()
    {
        $user = $this->getUser();
        $values = $this->request->getValues();

        if (! $this->userSession->isAdmin()) {
            $values = array(
                'id' => $this->userSession->getId(),
                'username' => isset($values['username']) ? $values['username'] : '',
                'name' => isset($values['name']) ? $values['name'] : '',
                'email' => isset($values['email']) ? $values['email'] : '',
                'timezone' => isset($values['timezone']) ? $values['timezone'] : '',
                'language' => isset($values['language']) ? $values['language'] : '',
            );
        }

        list($valid, $errors) = $this->userValidator->validateModification($values);

        if ($valid) {
            if ($this->userModel->update($values)) {
                $this->flash->success(t('User updated successfully.'));
                $this->response->redirect($this->helper->url->to('UserViewController', 'show', array('user_id' => $user['id'])), true);
                return;
            } else {
                $this->flash->failure(t('Unable to update this user.'));
            }
        }

        $this->show($values, $errors);
    }
The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.