<p>The form that lives at <a href="https://craftcms.com/docs/config-settings#setPasswordPath" rel="nofollow noreferrer">setPasswordPath</a> assumes that the user arrived there by clicking on the link in the validation email that was sent to the provided email address.  That link includes a <code>code=somelongid</code> querystring parameter in the URL that the form is looking for.</p>

<p>If you're just loading that URL directly, then you'll get the "Variable 'code' does not exist" error.  You could always do something like this to guard against it:</p>

<pre><code>{% set code = craft.request.getParam('code') %}

{% if not code %}
    {% exit 503 %}
{% endif %}
</code></pre>

<p>Regarding the forgot password form, upon successfully setting their new password, Craft will check to see if the user has control panel access.  If they do not, it will check the <a href="https://craftcms.com/docs/config-settings#setPasswordSuccessPath" rel="nofollow noreferrer">setPasswordSuccessPath</a> config variable and redirect there.  If they do, Craft will send them to the dashboard (which will redirect to the login page if you don't have <a href="https://craftcms.com/docs/config-settings#autoLoginAfterAccountActivation" rel="nofollow noreferrer">autoLoginAfterAccountActivation</a> set.</p>

CC BY-SA 3.0
2014-07-03T15:13:32.797Z
I'm still a bit unsure about the setPasswordPath mechanic. Can I load that form directly with no code query parameter? You have it exiting there, whereas I want to display the form. If I check whether it is set and then don't include the hidden code field if it isn't, submitting the form ends up with the same problem.
Alex H
CC BY-SA 3.0
2014-07-03T15:24:56.680Z
No, that form is only meant to be displayed when the user clicks the link in the email, whether that was generated from an account activation email, or a forgot password email.  The code in the querystring is absolutely necessary.  The additional check I gave in the example is just for if you're worried people will try to load the template directly.
Brad Bell
CC BY-SA 3.0
2014-07-03T15:38:28.097Z
Ah, okay, that makes sense, thanks. Is there a way to integrate change password functionality with the User Profile form? Or is the only way to change password via the email?
Alex H
CC BY-SA 3.0
2014-07-03T15:44:35.653Z
Yeah, but we don't exactly have that documented yet.  Basically it's a combination of http://buildwithcraft.com/docs/templating/user-profile-form and http://buildwithcraft.com/docs/templating/user-registration-form.  But users/saveProfile is no longer necessary and you can just call users/saveUser.  Also, when changing the password of an existing user, you need to inputs, one called "password" which is the user's *existing* password, and "newPassword", which is the new one. Craft will validate the existing one before updating to the new one.
Brad Bell
CC BY-SA 3.0
2014-07-03T15:45:29.953Z
Also, feel free to mark this as the answer as well. :)
Brad Bell
CC BY-SA 3.0
2014-07-03T15:50:45.720Z
Done, and cheers for your help Brad!
Alex H
CC BY-SA 3.0
2014-07-03T15:51:27.887Z
No problem... anytime!
Brad Bell
CC BY-SA 3.0
2014-12-04T03:56:31.390Z
If anyone stumbles upon this now - post craft 2.3 be aware that if you set the code variable:

    {% set code = craft.request.getParam('code') %}

It will cause an error and the activation code will not validate as you submit the form. In Craft 2.3 the activation code is reset again before rendering the template so if you override {{ code }} with the segment variable then you will be sending an expired Post variable in your form. If you remove that line you should be good to go.
Matt Green
CC BY-SA 3.0
2014-07-03T15:01:26.737Z
2017-10-25T23:56:55.360Z
2017-10-25T23:56:55.360Z
Brad Bell
<p>I have a couple of issues regarding administering users passwords from the front-end of my site.</p>

<p>Firstly, I'm trying to implement the Set Password form as listed at <a href="https://craftcms.com/docs/templating/set-password-form" rel="nofollow noreferrer">https://craftcms.com/docs/templating/set-password-form</a>.</p>

<p>I have created a single pointing to the path specified in the setPasswordPath config entry, using a template containing the above form. However, when I navigate to the setPasswordPath page it is erroring saying that 'Variable "code" does not exist'. When I remove the hidden code field, the id variable errors in the same way.</p>

<p>Secondly, the forgot password form listed at <a href="https://craftcms.com/docs/templating/forgot-password-form" rel="nofollow noreferrer">https://craftcms.com/docs/templating/forgot-password-form</a> works great, except for when the user navigates to the link in the e-mail, and then enters their new password, they are redirected the Craft dashboard login, which a lot of the end users should never really see. Is it possible to redirect people  to my home page login form on the front-end?</p>

<users><form>
How do I setup a password administration workflow using setPasswordPath and a forgot password page?
# How do I setup a password administration workflow using setPasswordPath and a forgot password page?

(Asked by: username_0 on 2014-07-03)

I have a couple of issues regarding administering users passwords from the front-end of my site.

Firstly, I'm trying to implement the Set Password form as listed at <https://craftcms.com/docs/templating/set-password-form>.

I have created a single pointing to the path specified in the setPasswordPath config entry, using a template containing the above form. However, when I navigate to the setPasswordPath page it is erroring saying that 'Variable "code" does not exist'. When I remove the hidden code field, the id variable errors in the same way.

Secondly, the forgot password form listed at <https://craftcms.com/docs/templating/forgot-password-form> works great, except for when the user navigates to the link in the e-mail, and then enters their new password, they are redirected the Craft dashboard login, which a lot of the end users should never really see. Is it possible to redirect people to my home page login form on the front-end?

**Tags:** users, form

---

## 1 answers

### Answer by username_1 on 2014-07-03. Score: 6 | Accepted answer

The form that lives at setPasswordPath assumes that the user arrived there by clicking on the link in the validation email that was sent to the provided email address.  That link includes a code=somelongid querystring parameter in the URL that the form is looking for.
If you're just loading that URL directly, then you'll get the "Variable 'code' does not exist" error.  You could always do something like this to guard against it:
{% set code = craft.request.getParam('code') %}

{% if not code %}
    {% exit 503 %}
{% endif %}

Regarding the forgot password form, upon successfully setting their new password, Craft will check to see if the user has control panel access.  If they do not, it will check the setPasswordSuccessPath config variable and redirect there.  If they do, Craft will send them to the dashboard (which will redirect to the login page if you don't have autoLoginAfterAccountActivation set.

> **Comments:**
> **username_0**: I'm still a bit unsure about the setPasswordPath mechanic. Can I load that form directly with no code query parameter? You have it exiting there, whereas I want to display the form. If I check whether it is set and then don't include the hidden code field if it isn't, submitting the form ends up with the same problem.  
> **username_1**: No, that form is only meant to be displayed when the user clicks the link in the email, whether that was generated from an account activation email, or a forgot password email.  The code in the querystring is absolutely necessary.  The additional check I gave in the example is just for if you're worried people will try to load the template directly.  
> **username_0**: Ah, okay, that makes sense, thanks. Is there a way to integrate change password functionality with the User Profile form? Or is the only way to change password via the email?  
> **username_1**: Yeah, but we don't exactly have that documented yet.  Basically it's a combination of http://buildwithcraft.com/docs/templating/user-profile-form and http://buildwithcraft.com/docs/templating/user-registration-form.  But users/saveProfile is no longer necessary and you can just call users/saveUser.  Also, when changing the password of an existing user, you need to inputs, one called "password" which is the user's *existing* password, and "newPassword", which is the new one. Craft will validate the existing one before updating to the new one.  
> **username_1**: Also, feel free to mark this as the answer as well. :)  
> **username_0**: Done, and cheers for your help Brad!  
> **username_1**: No problem... anytime!  
> **username_2**: If anyone stumbles upon this now - post craft 2.3 be aware that if you set the code variable:      {% set code = craft.request.getParam('code') %}  It will cause an error and the activation code will not validate as you submit the form. In Craft 2.3 the activation code is reset again before rendering the template so if you override {{ code }} with the segment variable then you will be sending an expired Post variable in your form. If you remove that line you should be good to go.  

---

