                $passwd = generate_password(PASSWORD_LENGTH);

                if (change_user_password($name, $passwd)) {
                    $email = safe_field("email", 'txp_users', "name = '".doSlash($name)."'");

                    if (send_new_password($passwd, $email, $name)) {
                        $changed[] = $name;
                        $msg = 'author_updated';
                    } else {
                        return author_list(array(gTxt('could_not_mail').' '.txpspecialchars($name), E_ERROR));
                    }
                }
            }

            break;
    }

    if ($changed) {
        return author_list(gTxt($msg, array('{name}' => txpspecialchars(join(', ', $changed)))));
    }

    author_list($msg);
}
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.