Sorry, I'm not familiar with which component does what, and you said that the Command already does the checks.

So, mayba core/commands/UserResetPasswordCommand.php process() should return that $t_result, and not just an array() ?

diff --git a/core/commands/UserResetPasswordCommand.php b/core/commands/UserResetPasswordCommand.php
index 000713da2..01a859310 100644
--- a/core/commands/UserResetPasswordCommand.php
+++ b/core/commands/UserResetPasswordCommand.php
@@ -96,7 +96,7 @@ class UserResetPasswordCommand extends Command {
} else {
$t_result = user_reset_failed_login_count_to_zero( $this->user_id_reset );
}

• return array();
• return array( $t_reset, $t_result );
  }
  }

diff --git a/manage_user_reset.php b/manage_user_reset.php
index 97c78a012..97004087b 100644
--- a/manage_user_reset.php
+++ b/manage_user_reset.php
@@ -52,7 +52,7 @@ $t_data = array(
);

$t_command = new UserResetPasswordCommand( $t_data );
-$t_command->execute();
+list( $t_reset, $t_result ) = $t_command->execute();

$t_redirect_url = 'manage_user_page.php';

@gthomas thanks for the prompt reply and proposed patch.

My initial idea to fix this was the same actually, i.e. have the command's execute() method return array( $t_reset, $t_result ) but this is a bit of an ugly hack so on second thought, I believe it would be cleaner to return a "proper" result code indicating what happened (i.e. password reset, account unlocked or failure).

I'm also wondering whether the command's validate() method shouldn't throw an exception if the user account is protected (which is the only case where user_reset_password() could return false).

PR https://github.com/mantisbt/mantisbt/pull/1655