src/User/Service/User.php
public function passwordRecovered($id) 
    {
        if(strlen($id) != 46) {
    		throw new \Exception('Not a valid password recover address');
        }
        
		$main = $this->getServiceLocator()->get('neobazaar.service.main');
		$em = $main->getEntityManager();
    	$userId = substr($id, 0, 6);
    	$passwordSha1 = substr($id, 6);
    	$user = $this->getEntity($userId);
    	$passwordBCrypt = sha1($user->getPassword());
    	
    	if($passwordBCrypt !== $passwordSha1) {
    		throw new \Exception('Error with code check');
    	}
		
		// generate a password
		$password = substr(sha1(rand()), 0, 8);
		$user->setPassword($this->getCryptedPassword($password));
		
		// verificare impostazione db vaori non obbligatori
		
		$userModel = $this->getServiceLocator()->get('user.model.user');
		$userModel->init($user, $this->getServiceLocator());
		$url = $this->getServiceLocator()->get('ControllerPluginManager')->get('Url');
		
		$event = new PasswordRecoveredEvent(__FUNCTION__, null, array(
		    'email' => $userModel->email, 
		    'password' => $password, 
		    'siteurl' => $url->fromRoute('home', array(), array('force_canonical' => true))
		));
    	
		$this->getEventManager()->trigger(__FUNCTION__ . '.pre', $this, $event);
		$em->persist($user);
		$em->flush();
		$this->getEventManager()->trigger(__FUNCTION__ . '.post', $this, $event);
		
		return $user;
    }
public function passwordRecovered($id) 
    {
        if(strlen($id) != 46) {
    		throw new \Exception('Not a valid password recover address');
        }
        
		$main = $this->getServiceLocator()->get('neobazaar.service.main');
		$em = $main->getEntityManager();
    	$userId = substr($id, 0, 6);
    	$passwordSha1 = substr($id, 6);
    	$user = $this->getEntity($userId);
    	$passwordBCrypt = sha1($user->getPassword());
    	
    	if($passwordBCrypt !== $passwordSha1) {
    		throw new \Exception('Error with code check');
    	}
		
		// generate a password
		$password = substr(sha1(rand()), 0, 8);
		$user->setPassword($this->getCryptedPassword($password));
		
		// verificare impostazione db vaori non obbligatori
		
		$userModel = $this->getServiceLocator()->get('user.model.user');
		$userModel->init($user, $this->getServiceLocator());
		$url = $this->getServiceLocator()->get('ControllerPluginManager')->get('Url');
		
		$event = new PasswordRecoveredEvent(__FUNCTION__, null, array(
		    'email' => $userModel->email, 
		    'password' => $password, 
		    'siteurl' => $url->fromRoute('home', array(), array('force_canonical' => true))
		));
    	
		$this->getEventManager()->trigger(__FUNCTION__ . '.pre', $this, $event);
		$em->persist($user);
		$em->flush();
		$this->getEventManager()->trigger(__FUNCTION__ . '.post', $this, $event);
		
		return $user;
    }
L'id in entrata è una strina da 80 caratteri,
i primi 40 sono l'id utente, i secondi 40 la sua attuale password
bcrypted passata in sha1.

@todo Absolutely get HASHID length from configuration!!!!!!!!!!!!
@param string $id
@throws \Exception
@return UserEntity