From d32dcd8ca73f19bb292b5fa0515bae915e3bcc9c Mon Sep 17 00:00:00 2001
From: rudrabjoshi <rudraj2022@gmail.com>
Date: Mon, 24 Aug 2026 11:26:10 -0700
Subject: [PATCH] Point "Forgot your password?" at the verified reset flow

profile.html: removed the old "New Password" field, which let a
logged-in user overwrite their password with zero verification (no
current-password check, no reset token). Replaced with a "Forgot your
password?" link into the verified reset flow. Cleaned up
saveChanges()'s now-dead password-save branch and the logout alert text
that referenced it.

login.md: adds the same "Forgot your password?" link, pointing at
/support?topic=reset (the wizard itself is the next PR in this stack).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 _layouts/profile.html              | 31 +++---------------------------
 navigation/authentication/login.md |  3 +++
 2 files changed, 6 insertions(+), 28 deletions(-)

diff --git a/_layouts/profile.html b/_layouts/profile.html
index b19f088105..49cb09a16f 100644
--- a/_layouts/profile.html
+++ b/_layouts/profile.html
@@ -58,11 +58,8 @@ <h2 class="text-xl font-semibold mb-6">Personal Information</h2>
 
             <!-- Password Change -->
             <div>
-                <label for="password" class="block text-sm font-medium text-gray-300 mb-1">New
-                    Password</label>
-                <input type="password" id="password" name="password"
-                    class="w-full px-4 py-2 rounded-lg border border-gray-600 bg-neutral-700 focus:outline-none focus:ring-2 focus:ring-indigo-500"
-                    placeholder="Enter new password" onchange="checkForChanges()" autocomplete="new-password">
+                <label class="block text-sm font-medium text-gray-300 mb-1">Password</label>
+                <a href="{{ site.baseurl }}/support?topic=reset" class="text-sm text-indigo-400 hover:text-indigo-300 inline-block">Forgot your password?</a>
             </div>
         </div>
     </div>
@@ -1317,7 +1314,6 @@ <h4 class="text-red-400 font-semibold mb-1">Selection Failed</h4>
         const uidInput = document.getElementById("uidChangeInput");
         const emailInput = document.getElementById("emailChangeInput");
         const sidInput = document.getElementById("sidChangeInput");
-        const passwordInput = document.getElementById("password");
         const kasmInput = document.getElementById("kasmChangeInput");
         const schoolInput = document.getElementById("schoolChangeInput");
 
@@ -1326,7 +1322,6 @@ <h4 class="text-red-400 font-semibold mb-1">Selection Failed</h4>
         const uid = uidInput.value.trim();
         const email = emailInput.value.trim();
         const sid = sidInput.value.trim();
-        const password = passwordInput.value.trim();
         const kasmServerNeeded = kasmInput ? kasmInput.checked : undefined;
         const school = schoolInput.value;
 
@@ -1422,26 +1417,6 @@ <h4 class="text-red-400 font-semibold mb-1">Selection Failed</h4>
             }
         }
 
-        // save password (both backends, logs out)
-        if (password) {
-            try {
-                await Promise.all([
-                    putUpdate({
-                        URL: pythonURI + "/api/user",
-                        body: { password },
-                        message: 'password-message'
-                    }),
-                    postUpdate({
-                        URL: javaURI + "/api/person/update",
-                        body: { password }
-                    })
-                ]);
-                needsLogout = true;
-            } catch (e) {
-                console.error("error saving password:", e.message);
-            }
-        }
-
         // save kasm server status (both backends)
         if (
             typeof kasmServerNeeded !== "undefined" &&
@@ -1511,7 +1486,7 @@ <h4 class="text-red-400 font-semibold mb-1">Selection Failed</h4>
 
         // handle reload or logout if needed
         if (needsLogout) {
-            alert("you updated your github id or password, so you will be logged out. remember your new credentials!");
+            alert("you updated your github id, so you will be logged out. remember your new credentials!");
             window.location.href = '{{site.baseurl}}';
         } else if (needsReload) {
             window.location.reload();
diff --git a/navigation/authentication/login.md b/navigation/authentication/login.md
index 296da6aede..8ecbd81302 100644
--- a/navigation/authentication/login.md
+++ b/navigation/authentication/login.md
@@ -25,6 +25,9 @@ show_reading_time: false
                 <button type="submit" class="large primary submit-button">Login</button>
             </p>
             <p id="message" style="color: red;"></p>
+            <p style="text-align: center;">
+                <a href="{{site.baseurl}}/support?topic=reset">Forgot your password?</a>
+            </p>
         </form>
     </div>
     <div class="signup-card">