    void sendResetPasswordEmailRequest() throws Exception
    {
        when(this.referenceSerializer.serialize(this.userReference)).thenReturn("user:Foobar");
        when(this.userProperties.getFirstName()).thenReturn("Foo");
        when(this.userProperties.getLastName()).thenReturn("Bar");

        AuthenticationResourceReference resourceReference =
            new AuthenticationResourceReference(AuthenticationAction.RESET_PASSWORD);

        String verificationCode = "foobar4242";
        resourceReference.addParameter("u", "user:Foobar");
        resourceReference.addParameter("v", verificationCode);
        ExtendedURL firstExtendedURL =
            new ExtendedURL(Arrays.asList("authenticate", "reset"), resourceReference.getParameters());
        when(this.resourceReferenceSerializer.serialize(resourceReference)).thenReturn(firstExtendedURL);
        when(this.urlNormalizer.normalize(firstExtendedURL)).thenReturn(
            new ExtendedURL(Arrays.asList("xwiki", "authenticate", "reset"), resourceReference.getParameters())
        );
        XWikiURLFactory urlFactory = mock(XWikiURLFactory.class);
        when(this.context.getURLFactory()).thenReturn(urlFactory);
        when(urlFactory.getServerURL(this.context)).thenReturn(new URL("http://xwiki.org"));

        InternetAddress email = new InternetAddress("foobar@xwiki.org");
        DefaultResetPasswordRequestResponse requestResponse =
            new DefaultResetPasswordRequestResponse(this.userReference, email,
                verificationCode);
        this.resetPasswordManager.sendResetPasswordEmailRequest(requestResponse);
        verify(this.resetPasswordMailSender).sendResetPasswordEmail("Foo Bar", email,
            new URL("http://xwiki.org/xwiki/authenticate/reset?u=user%3AFoobar&v=foobar4242"));
    }
The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.